Apache Software Foundation Apache Jackrabbit vulnerabilities
3 known vulnerabilities affecting apache_software_foundation/apache_jackrabbit.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2026-92414P3CRITICALCVSS 9.1≥ 2.23.0, ≤ 2.23.5≥ 2.22.0, ≤ 2.22.4+1 more2026-10-07
CVE-2026-92414 [CRITICAL] CWE-384 CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit We
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with
no credential check.
This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, fro
nvd
CVE-2025-53689P3HIGHCVSS 8.8≥ 2.20.0, < 2.20.17≥ 2.22.0, < 2.22.1+1 more2025-07-14
CVE-2025-53689 [HIGH] CWE-611 CVE-2025-53689: Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not support
nvd
CVE-2026-92415P3MEDIUMCVSS 5.3≥ 2.23.0, ≤ 2.23.5≥ 2.22.0, ≤ 2.22.4+1 more2026-10-07
CVE-2026-92415 [MEDIUM] CWE-470 CVE-2026-92415: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client.
A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.
Only application
nvd