CVE-2015-1833

Improper Input Validation in Apache Jackrabbit

6.4 MediumPublic exploitFix available

CVE-2015-1833 is a medium vulnerability (CVSS 6.4) in Apache Jackrabbit, published May 29, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 55.9%, the 99th percentile. Fixed in org.apache.jackrabbit:jackrabbit-core 2.0.6.

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.

Exploit likelihood

55.9%Up 26.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.4

Record: CVE-2015-1833
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-1833
Updated: 2026-11-02

EUVDEUVD-2022-3268 No score

Record: EUVD-2022-3268
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9284-j4c9-779q No score

Improper Input Validation in Apache Jackrabbit

Record: GHSA-9284-j4c9-779q
Weakness: CWE-20
Updated: 2026-11-02

OSV No score

Record: CVE-2015-1833
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-1833 No score

Record: DEBIAN-CVE-2015-1833
Updated: 2026-11-02

OSVGHSA-9284-j4c9-779q No score

Improper Input Validation in Apache Jackrabbit

Record: GHSA-9284-j4c9-779q
Weakness: CWE-20
Updated: 2026-11-02

OSVMGASA-2015-0242 No score

Updated jackrabbit packages fix CVE-2015-1833

Updated jackrabbit packages fix security vulnerability:

In Apache Jackrabbit before 2.4.6, When processing a WebDAV request body containing XML, the XML parser can be instructed to read content from network resources accessible to the host, identified by URI schemes such as "http(s)" or "file". Depending on the WebDAV request, this can not only be used to trigger internal network requests, but might also be used to insert said content into the request, potentially exposing it to the attacker and others (for instance, by inserting said content in a WebDAV property value using a PROPPATCH request). See also IETF RFC 4918, Section 20.6 (CVE-2015-1833).

Record: MGASA-2015-0242
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-1833 No score

Record: UBUNTU-CVE-2015-1833
Updated: 2026-11-02

Affected products

apache jackrabbit

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.jackrabbit:jackrabbit-core` Maven	through 2.0.5	2.0.6
`org.apache.jackrabbit:jackrabbit-core` Maven	2.2.0 to 2.2.13	2.2.14
`org.apache.jackrabbit:jackrabbit-core` Maven	2.4.0 to 2.4.5	2.4.6
`org.apache.jackrabbit:jackrabbit-core` Maven	2.6.0 to 2.6.5	2.6.6
`org.apache.jackrabbit:jackrabbit-core` Maven	2.8.0 to 2.8.0	2.8.1
`org.apache.jackrabbit:jackrabbit-core` Maven	2.10.0 to 2.10.0	2.10.1
`jackrabbit` Debian:12	before 2.10.1-1	2.10.1-1
`jackrabbit` Debian:13	before 2.10.1-1	2.10.1-1
`jackrabbit` Debian:14	before 2.10.1-1	2.10.1-1
`jackrabbit` Debian:7	before 2.3.6-1+deb7u1, plus listed versions 2.3.6-1	2.3.6-1+deb7u1

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`jackrabbit` Debian:8	before 2.3.6-1+deb8u1, plus listed versions 2.3.6-1	2.3.6-1+deb8u1
`org.apache.jackrabbit:jackrabbit-core` Maven	before 2.0.6, plus listed versions 1.01.0.11.11.1.11.2.1 Show 38 moreShow less 1.2.21.2.31.31.3.11.3.31.41.4.11.4.101.4.111.4.121.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.01.5.21.5.31.5.41.5.51.5.61.5.71.6.01.6.11.6.21.6.41.6.52.0-beta12.0-beta32.0-beta42.0-beta52.0-beta62.0.02.0.32.0.5	2.0.6
`org.apache.jackrabbit:jackrabbit-core` Maven	2.2.0 up to 2.2.14, plus listed versions 2.2.12.2.102.2.112.2.122.2.13 Show 6 moreShow less 2.2.22.2.42.2.52.2.72.2.82.2.9	2.2.14
`org.apache.jackrabbit:jackrabbit-core` Maven	2.4.0 up to 2.4.6, plus listed versions 2.4.12.4.22.4.32.4.42.4.5	2.4.6
`org.apache.jackrabbit:jackrabbit-core` Maven	2.6.0 up to 2.6.6, plus listed versions 2.6.12.6.22.6.32.6.42.6.5	2.6.6
`org.apache.jackrabbit:jackrabbit-core` Maven	2.8.0 up to 2.8.1	2.8.1
`org.apache.jackrabbit:jackrabbit-core` Maven	2.10.0 up to 2.10.1	2.10.1
`jackrabbit` Mageia:4	before 2.4.2-6.1.mga4	2.4.2-6.1.mga4
`jackrabbit` Ubuntu:14.04:LTS	before 2.3.6-1+deb8u1build0.14.04.1, plus listed versions 2.3.6-1	2.3.6-1+deb8u1build0.14.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache JackRabbit - WebDAV XML External Entity	2015-05-26

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 19 moreShow less