Skip to content

Product

apache jackrabbit vulnerabilities

4 published CVES affecting apache jackrabbit, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
1
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest apache jackrabbit CVEs

Newest publication first

  1. CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

    Published
    CriticalCVSS 9.8

    Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that c...

  2. CVE-2016-6801 Apache Jackrabbit Authentication Hijacking Vulnerability

    Published
    HighCVSS 8.8

    Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hij...

  3. CVE-2015-1833 Improper Input Validation in Apache Jackrabbit

    Published
    MediumCVSS 6.4 EPSS 55.9% Public exploit

    XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.