Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Priority MEDIUM 41CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0054 45th percentileScored 2026-11-07
Fix Partial Apache Jackrabbit (Apache Software Foundation): 2.20.17, 2.22.1, 2.23.2-betaorg.apache.jackrabbit:jackrabbit-spi-commons (Maven): 2.20.17, 2.22.1, 2.23.2-beta+1 more productRed Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Jackrabbit | 2.20.0 to before 2.20.17; 2.22.0 to before 2.22.1; 2.23.0-beta to before 2.23.2-beta | 2.20.17, 2.22.1, 2.23.2-beta | Patch available | CNA |
| — | org.apache.jackrabbit:jackrabbit-spi-commons (Maven) | 2.20.0 to before 2.20.17 | 2.20.17 | Patch available | GHSA-44c3-38h8-9fh9 |
| — | org.apache.jackrabbit:jackrabbit-spi-commons (Maven) | 2.22.0 to before 2.22.1 | 2.22.1 | Patch available | GHSA-44c3-38h8-9fh9 |
| — | org.apache.jackrabbit:jackrabbit-spi-commons (Maven) | 2.23.0-beta to before 2.23.2-beta | 2.23.2-beta | Patch available | GHSA-44c3-38h8-9fh9 |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.23.0-beta to before 2.23.2-beta | 2.23.2-beta | Patch available | GHSA-44c3-38h8-9fh9 |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.20.0 to before 2.20.17 | 2.20.17 | Patch available | GHSA-44c3-38h8-9fh9 |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.22.0 to before 2.22.1 | 2.22.1 | Patch available | GHSA-44c3-38h8-9fh9 |
- Apache Jackrabbit VendorApache Affected 2.20.0 to before 2.20.17; 2.22.0 to before 2.22.1; 2.23.0-beta to before 2.23.2-beta Fixed in 2.20.17, 2.22.1, 2.23.2-beta Patch available CNA
- org.apache.jackrabbit:jackrabbit-spi-commons (Maven) Vendor— Affected 2.20.0 to before 2.20.17 Fixed in 2.20.17 Patch available GHSA-44c3-38h8-9fh9
- org.apache.jackrabbit:jackrabbit-spi-commons (Maven) Vendor— Affected 2.22.0 to before 2.22.1 Fixed in 2.22.1 Patch available GHSA-44c3-38h8-9fh9
- org.apache.jackrabbit:jackrabbit-spi-commons (Maven) Vendor— Affected 2.23.0-beta to before 2.23.2-beta Fixed in 2.23.2-beta Patch available GHSA-44c3-38h8-9fh9
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.23.0-beta to before 2.23.2-beta Fixed in 2.23.2-beta Patch available GHSA-44c3-38h8-9fh9
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.20.0 to before 2.20.17 Fixed in 2.20.17 Patch available GHSA-44c3-38h8-9fh9
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.22.0 to before 2.22.1 Fixed in 2.22.1 Patch available GHSA-44c3-38h8-9fh9
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* | 2.20.0 to before 2.20.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.22.0:*:*:*:*:*:*:* | 2.22.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.23.0:beta:*:*:*:*:*:* | 2.23.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.23.1:beta:*:*:*:*:*:* | 2.23.1 beta | Vulnerable | Apache |
- cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* Versions 2.20.0 to before 2.20.17 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.22.0:*:*:*:*:*:*:* Versions 2.22.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.23.0:beta:*:*:*:*:*:* Versions 2.23.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.23.1:beta:*:*:*:*:*:* Versions 2.23.1 beta Vulnerable ·Apache
Remediation
- Fix · CNA Apache Jackrabbit (Apache Software Foundation) Fixed in 2.20.17, 2.22.1, 2.23.2-beta
- Fix · GHSA-44c3-38h8-9fh9 org.apache.jackrabbit:jackrabbit-spi-commons (Maven) Fixed in 2.20.17 Advisory →
- Fix · GHSA-44c3-38h8-9fh9 org.apache.jackrabbit:jackrabbit-spi-commons (Maven) Fixed in 2.22.1 Advisory →
- Fix · GHSA-44c3-38h8-9fh9 org.apache.jackrabbit:jackrabbit-spi-commons (Maven) Fixed in 2.23.2-beta Advisory →
- Fix · GHSA-44c3-38h8-9fh9 org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.23.2-beta Advisory →
- Fix · GHSA-44c3-38h8-9fh9 org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.20.17 Advisory →
- Fix · GHSA-44c3-38h8-9fh9 org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.22.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53689
- 2026-10-03 Alias added: GHSA-44c3-38h8-9fh9
References
Advisory 2
More Apache Jackrabbit vulnerabilities
- TI-2015-01646 XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before… CVSS 2.0MEDIUM 6.4
- TI-2023-19328 Apache Jackrabbit RMI access can lead to RCE CVSS 3.1CRITICAL 9.8
- TI-2026-69192 Session hijacking in Apache Jackrabbit WebDAV server CVSS 4.0CRITICAL 9.3
- TI-2016-05842 Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in… CVSS 3.0HIGH 8.8
- TI-2009-00026 Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2… CVSS 2.0MEDIUM 4.3
- TI-2026-69193 Apache Jackrabbit DavEx client can instantiate arbitrary classes CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-53689 · CVE Program
- CVE-2025-53689 · NVD
- FIRST EPSS
- GHSA-44c3-38h8-9fh9 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-53689 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences