org.apache.jackrabbit/oak-core vulnerabilities

Latest org.apache.jackrabbit/oak-core CVEs

Newest publication first

1. CVE-2020-1940 Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak

   Published 2020-01-28

   High·CVSS 7.5 EPSS 4.5%

   The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.