CVE-2015-1833

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.

CVSS v2.0 NVD

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

55.95% chance of exploitation in the next 30 days, 99th percentile

Published

2015-05-29

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/37110

Security advisories

• http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080…
• http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt
• https://issues.apache.org/jira/browse/JCR-3883
• advisories/GHSA-9284-j4c9-779q
• http://www.securityfocus.com/bid/74761

References

• CVE Record
• NVD entry