CVE-2015-1833: Improper Input Validation in Apache Jackrabbit
Summary
CVE-2015-1833: Improper Input Validation in Apache Jackrabbit. Affects org.apache.jackrabbit:jackrabbit-core across 6 version ranges.
< 2.0.6
>= 2.2.0, < 2.2.14
>= 2.4.0, < 2.4.6
>= 2.6.0, < 2.6.6
>= 2.8.0, < 2.8.1
>= 2.10.0, < 2.10.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jackrabbit · Debian:11
The same CVE-2015-1833 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Jackrabbit is an open-source content repository for the Java platform. It provides support for hierarchical content storage with support for versioning, full-text search, and access control. The vulnerability in Apache Jackrabbit allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Vulnerability Detail
The vulnerability in Apache Jackrabbit is an XML external entity (XXE) vulnerability. It exists in versions before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1. This vulnerability allows remote attackers to exploit the application by reading arbitrary files and sending requests to intranet servers. By crafting a malicious WebDAV request, an attacker can manipulate the XML parsing process and gain unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.62.0.6 -
>= 2.2.0, < 2.2.142.2.14 -
>= 2.4.0, < 2.4.62.4.6 -
>= 2.6.0, < 2.6.62.6.6 -
>= 2.8.0, < 2.8.12.8.1 -
>= 2.10.0, < 2.10.12.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by the Apache Jackrabbit project.
Conclusion
The vulnerability in Apache Jackrabbit allows remote attackers to read arbitrary files and send requests to intranet servers. It is recommended to upgrade to the fixed versions of Apache Jackrabbit to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jackrabbit:jackrabbit-core →
FAQ
Apache Jackrabbit is an open-source content repository for the Java platform. It provides support for hierarchical content storage with support for versioning, full-text search, and access control.
An XML external entity (XXE) vulnerability is a type of security vulnerability that allows an attacker to read arbitrary files and send requests to intranet servers by manipulating the XML parsing process.
This vulnerability can be exploited by crafting a malicious WebDAV request that manipulates the XML parsing process in Apache Jackrabbit, allowing the attacker to read arbitrary files and send requests to intranet servers.
No, there are no known workarounds for this vulnerability. It is recommended to apply the fix provided by the Apache Jackrabbit project.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Jackrabbit. Please refer to the 'how_to_fix' section for specific version information.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jackrabbit:jackrabbit-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
