Read the docs
TI-2023-19328 Aliases CVE-2023-37895GHSA-q8cm-3v62-jj79

Apache Jackrabbit RMI access can lead to RCE

Priority MEDIUM 55CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone. The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control. Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:         <servlet>             <servlet-name>RMI</servlet-name>             <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class>         </servlet>         <servlet-mapping>             <servlet-name>RMI</servlet-name>             <url-pattern>/rmi</url-pattern>         </servlet-mapping> Find the bootstrap.properties file (in $REPOSITORY_HOME), and set         rmi.enabled=false     and also remove         rmi.host         rmi.port         rmi.url-pattern  If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03239 88th percentileScored 2026-11-07
Fix Fixed Apache Jackrabbit Webapp (jackrabbit-webapp) (Apache Software Foundation): 2.21.18, 2.20.11Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) (Apache Software Foundation): 2.21.18, 2.20.11+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Jackrabbit Webapp (jackrabbit-webapp)2.21.0 to before 2.21.18; 1.0.0 to before 2.20.112.21.18, 2.20.11Patch availableCNA
ApacheApache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components)2.21.0 to before 2.21.18; 1.0.0 to before 2.20.112.21.18, 2.20.11Patch availableCNA
—org.apache.jackrabbit:jackrabbit-webapp (Maven)2.21.0 to before 2.21.182.21.18Patch availableGHSA-q8cm-3v62-jj79
—org.apache.jackrabbit:jackrabbit-webapp (Maven)1.0.0 to before 2.20.112.20.11Patch availableGHSA-q8cm-3v62-jj79
—org.apache.jackrabbit:jackrabbit-standalone (Maven)2.21.0 to before 2.21.182.21.18Patch availableGHSA-q8cm-3v62-jj79
—org.apache.jackrabbit:jackrabbit-standalone (Maven)1.0.0 to before 2.20.112.20.11Patch availableGHSA-q8cm-3v62-jj79
—org.apache.jackrabbit:jackrabbit-standalone-components (Maven)2.21.0 to before 2.21.182.21.18Patch availableGHSA-q8cm-3v62-jj79
—org.apache.jackrabbit:jackrabbit-standalone-components (Maven)1.0.0 to before 2.20.112.20.11Patch availableGHSA-q8cm-3v62-jj79
  • Apache Jackrabbit Webapp (jackrabbit-webapp) VendorApache Affected 2.21.0 to before 2.21.18; 1.0.0 to before 2.20.11 Fixed in 2.21.18, 2.20.11 Patch available CNA
  • Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) VendorApache Affected 2.21.0 to before 2.21.18; 1.0.0 to before 2.20.11 Fixed in 2.21.18, 2.20.11 Patch available CNA
  • org.apache.jackrabbit:jackrabbit-webapp (Maven) Vendor— Affected 2.21.0 to before 2.21.18 Fixed in 2.21.18 Patch available GHSA-q8cm-3v62-jj79
  • org.apache.jackrabbit:jackrabbit-webapp (Maven) Vendor— Affected 1.0.0 to before 2.20.11 Fixed in 2.20.11 Patch available GHSA-q8cm-3v62-jj79
  • org.apache.jackrabbit:jackrabbit-standalone (Maven) Vendor— Affected 2.21.0 to before 2.21.18 Fixed in 2.21.18 Patch available GHSA-q8cm-3v62-jj79
  • org.apache.jackrabbit:jackrabbit-standalone (Maven) Vendor— Affected 1.0.0 to before 2.20.11 Fixed in 2.20.11 Patch available GHSA-q8cm-3v62-jj79
  • org.apache.jackrabbit:jackrabbit-standalone-components (Maven) Vendor— Affected 2.21.0 to before 2.21.18 Fixed in 2.21.18 Patch available GHSA-q8cm-3v62-jj79
  • org.apache.jackrabbit:jackrabbit-standalone-components (Maven) Vendor— Affected 1.0.0 to before 2.20.11 Fixed in 2.20.11 Patch available GHSA-q8cm-3v62-jj79

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*1.0.0 to before 2.20.11; 2.21.0 to before 2.21.18VulnerableApache
  • cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* Versions 1.0.0 to before 2.20.11; 2.21.0 to before 2.21.18 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Jackrabbit Webapp (jackrabbit-webapp) (Apache Software Foundation) Fixed in 2.21.18, 2.20.11
  • Fix · CNA Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) (Apache Software Foundation) Fixed in 2.21.18, 2.20.11
  • Fix · GHSA-q8cm-3v62-jj79 org.apache.jackrabbit:jackrabbit-webapp (Maven) Fixed in 2.21.18 Advisory →
  • Fix · GHSA-q8cm-3v62-jj79 org.apache.jackrabbit:jackrabbit-webapp (Maven) Fixed in 2.20.11 Advisory →
  • Fix · GHSA-q8cm-3v62-jj79 org.apache.jackrabbit:jackrabbit-standalone (Maven) Fixed in 2.21.18 Advisory →
  • Fix · GHSA-q8cm-3v62-jj79 org.apache.jackrabbit:jackrabbit-standalone (Maven) Fixed in 2.20.11 Advisory →
  • Fix · GHSA-q8cm-3v62-jj79 org.apache.jackrabbit:jackrabbit-standalone-components (Maven) Fixed in 2.21.18 Advisory →
  • Fix · GHSA-q8cm-3v62-jj79 org.apache.jackrabbit:jackrabbit-standalone-components (Maven) Fixed in 2.20.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37895
  2. 2026-10-03 Alias added: GHSA-q8cm-3v62-jj79

References

Advisory 4

Other 2

  • TI-2015-01646 XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before… CVSS 2.0MEDIUM 6.4
  • TI-2026-69192 Session hijacking in Apache Jackrabbit WebDAV server CVSS 4.0CRITICAL 9.3
  • TI-2016-05842 Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in… CVSS 3.0HIGH 8.8
  • TI-2009-00026 Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2… CVSS 2.0MEDIUM 4.3
  • TI-2025-33606 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons CVSS 3.1HIGH 8.8
  • TI-2026-69193 Apache Jackrabbit DavEx client can instantiate arbitrary classes CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences