CVE-2015-1833 Improper Input Validation in Apache Jackrabbit
MediumCVSS 6.4
EPSS 55.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.jackrabbit/jackrabbit-core(Maven) | < 2.0.6 | 2.0.6 |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.0.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.1.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.2.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.2.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.2.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.3.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.3.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.10 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.11 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.12 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.6 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.7 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.8 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.4.9 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.0 | No fix listed |
Show 84 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.6 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.5.7 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.6.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.6.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.6.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.6.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 1.6.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0-beta1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0-beta3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0-beta4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0-beta5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0-beta6 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.0.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.2.0, < 2.2.14 | 2.2.14 |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.10 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.11 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.12 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.13 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.7 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.8 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.2.9 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.4.0, < 2.4.6 | 2.4.6 |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.4.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.4.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.4.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.4.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.4.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.4.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.6.0, < 2.6.6 | 2.6.6 |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.6.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.6.1 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.6.2 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.6.3 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.6.4 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.6.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.8.0, < 2.8.1 | 2.8.1 |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.8.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.10.0, < 2.10.1 | 2.10.1 |
| org.apache.jackrabbit/jackrabbit-core(Maven) | = 2.10.0 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | <= 2.0.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.2.0, <= 2.2.13 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.4.0, <= 2.4.5 | No fix listed |
| org.apache.jackrabbit/jackrabbit-core(Maven) | >= 2.6.0, <= 2.6.5 | No fix listed |
| debian/jackrabbit(Debian:12) | < 2.10.1-1 | 2.10.1-1 |
| debian/jackrabbit(Debian:13) | < 2.10.1-1 | 2.10.1-1 |
| debian/jackrabbit(Debian:14) | < 2.10.1-1 | 2.10.1-1 |
| apache jackrabbit | <= 2.0.5 | No fix listed |
| apache jackrabbit | = 2.2.0 | No fix listed |
| apache jackrabbit | = 2.2.1 | No fix listed |
| apache jackrabbit | = 2.2.2 | No fix listed |
| apache jackrabbit | = 2.2.4 | No fix listed |
| apache jackrabbit | = 2.2.5 | No fix listed |
| apache jackrabbit | = 2.2.7 | No fix listed |
| apache jackrabbit | = 2.2.8 | No fix listed |
| apache jackrabbit | = 2.2.9 | No fix listed |
| apache jackrabbit | = 2.2.10 | No fix listed |
| apache jackrabbit | = 2.2.11 | No fix listed |
| apache jackrabbit | = 2.2.12 | No fix listed |
| apache jackrabbit | = 2.2.13 | No fix listed |
| apache jackrabbit | = 2.4.0 | No fix listed |
| apache jackrabbit | = 2.4.1 | No fix listed |
| apache jackrabbit | = 2.4.2 | No fix listed |
| apache jackrabbit | = 2.4.3 | No fix listed |
| apache jackrabbit | = 2.4.4 | No fix listed |
| apache jackrabbit | = 2.4.5 | No fix listed |
| apache jackrabbit | = 2.6.0 | No fix listed |
| apache jackrabbit | = 2.6.1 | No fix listed |
| apache jackrabbit | = 2.6.2 | No fix listed |
| apache jackrabbit | = 2.6.3 | No fix listed |
| apache jackrabbit | = 2.6.4 | No fix listed |
| apache jackrabbit | = 2.6.5 | No fix listed |
| apache jackrabbit | = 2.8.0 | No fix listed |
| apache jackrabbit | = 2.10.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-1833 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com product
- issues.apache.org vendor-advisory
- 37110 exploit
- [jackrabbit-announce] 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) mailing-list vendor-advisory
- packetstormsecurity.com exploit
- www.apache.org vendor-advisory
- DSA-3298 vendor-advisory
- github.com
- 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) mailing-list
- 74761 vdb-entry