Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-53689

Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Jackrabbit

Default version status: unaffected

  • 2.20.0 to < 2.20.17affected
  • 2.22.0 to < 2.22.1affected
  • 2.23.0-beta to < 2.23.2-betaaffected

References