CVE-2025-53689: Apache Jackrabbit Vulnerable to Blind XXE Attack in jackrabbit-spi-commons and jackrabbit-core
Summary
CVE-2025-53689: Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build. Affects org.apache.jackrabbit:jackrabbit-spi-commons across 3 version ranges.
>= 2.20.0, < 2.20.17
>= 2.22.0, < 2.22.1
>= 2.23.0-beta, < 2.23.2-beta
Fixed in 2.20.17, 2.22.1 or 2.23.2-beta, depending on the release line you run. How to fix ↓
Also tracked for
- jackrabbit · Debian:11
The same CVE-2025-53689 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Jackrabbit is an open-source content repository for Java that implements the Java Content Repository (JCR) API. It is designed to store, manage, and retrieve content in a hierarchical structure. Jackrabbit is widely used in enterprise applications for its flexibility and scalability. However, certain versions of jackrabbit-spi-commons and jackrabbit-core are vulnerable to blind XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from the use of an unsecured document build to load privileges in Apache Jackrabbit versions prior to 2.23.2. This flaw allows attackers to exploit the XML parsing process, potentially leading to the disclosure of sensitive information or manipulation of the application’s behavior. The severity of this vulnerability is rated high, with a CVSS score of 8.8, indicating a significant risk to users who have not updated to the patched versions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.20.0, < 2.20.172.20.17 -
>= 2.22.0, < 2.22.12.22.1 -
>= 2.23.0-beta, < 2.23.2-beta2.23.2-beta
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can disable XML external entity processing in their XML parsers to mitigate the risk of exploitation until they can upgrade to the patched versions. This can typically be done by configuring the XML parser settings in the application code.
Conclusion
The blind XXE vulnerability in Apache Jackrabbit's jackrabbit-spi-commons and jackrabbit-core poses a significant risk to users of affected versions. It is crucial to upgrade to the patched versions to mitigate this risk. Users should also consider using tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for org.apache.jackrabbit:jackrabbit-spi-commons →
FAQ
A blind XXE vulnerability allows an attacker to exploit XML parsing to access sensitive data without receiving direct feedback from the application.
Versions of Apache Jackrabbit prior to 2.23.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can check your application using the Vulert playground without signup.
If immediate upgrading is not possible, consider disabling XML external entity processing in your XML parsers as a temporary workaround.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
