{"id":"CVE-2015-1833","aliases":["DEBIAN-CVE-2015-1833","DSA-3298-1","EUVD-2022-3268","GHSA-9284-j4c9-779q","MGASA-2015-0242","UBUNTU-CVE-2015-1833"],"status":"published","title":"Improper Input Validation in Apache Jackrabbit","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.55949,"percentile":0.99052,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2015-05-29T15:00:00Z","modified":"2026-09-09T06:47:18Z","exploits":[{"source":"exploitdb","id":"EDB-37110","title":"Apache JackRabbit - WebDAV XML External Entity","type":"webapps","platform":"java","date":"2015-05-26","url":"https://www.exploit-db.com/exploits/37110"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","fixed_in":["2.0.6","2.2.14","2.4.6","2.6.6","2.8.1","2.10.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jackrabbit","fixed_in":["2.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jackrabbit","fixed_in":["2.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jackrabbit","fixed_in":["2.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"jackrabbit","fixed_in":["2.3.6-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"jackrabbit","fixed_in":["2.3.6-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"jackrabbit","fixed_in":["2.4.2-6.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"jackrabbit","fixed_in":["2.3.6-1+deb8u1build0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.5"},{"fixed":"2.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.2.13"},{"fixed":"2.2.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"last_affected":"2.4.5"},{"fixed":"2.4.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"last_affected":"2.6.5"},{"fixed":"2.6.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"last_affected":"2.8.0"},{"fixed":"2.8.1"}]}],"versions":["2.8.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"last_affected":"2.10.0"},{"fixed":"2.10.1"}]}],"versions":["2.10.0"]},{"source":"osv","ecosystem":"Debian:12","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-1+deb7u1"}]}],"versions":["2.3.6-1"]},{"source":"osv","ecosystem":"Debian:8","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-1+deb8u1"}]}],"versions":["2.3.6-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}],"versions":["1.0","1.0.1","1.1","1.1.1","1.2.1","1.2.2","1.2.3","1.3","1.3.1","1.3.3","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6.0","1.6.1","1.6.2","1.6.4","1.6.5","2.0-beta1","2.0-beta3","2.0-beta4","2.0-beta5","2.0-beta6","2.0.0","2.0.3","2.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.14"}]}],"versions":["2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.2","2.2.4","2.2.5","2.2.7","2.2.8","2.2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.6"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.6"}]}],"versions":["2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.1"}]}],"versions":["2.8.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.jackrabbit:jackrabbit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.1"}]}],"versions":["2.10.0"]},{"source":"osv","ecosystem":"Mageia:4","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-6.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jackrabbit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-1+deb8u1build0.14.04.1"}]}],"versions":["2.3.6-1"]}],"products":[{"vendor":"apache","product":"jackrabbit"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3298","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/74761","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/37110/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","evidence"]},{"url":"http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/535582/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/JCR-3883","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1833","tags":["advisory"]},{"url":"https://github.com/apache/jackrabbit/commit/17e9f68f5a3f05ded20569777a7b07422680612d","tags":["web"]},{"url":"https://github.com/apache/jackrabbit/commit/26e601934d0f439f0a61d62265f52936d79df40d","tags":["web"]},{"url":"https://github.com/apache/jackrabbit/commit/3903739363b79deb7579802fbc27b9b7448218b2","tags":["web"]},{"url":"https://github.com/apache/jackrabbit/commit/6191b366c607e65325a0116097aca8a359b36486","tags":["web"]},{"url":"https://github.com/apache/jackrabbit/commit/89c5c4ed6ab250ad609829517f167d2dbe0abdd0","tags":["web"]},{"url":"https://github.com/apache/jackrabbit/commit/b7fa1ae39641936872617ff95363353b0345b777","tags":["web"]},{"url":"https://github.com/apache/jackrabbit/commit/ddf9a3cd408397d0805917299c4114b09449373d","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/37110","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9284-j4c9-779q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1833","tags":["advisory"]},{"url":"https://github.com/apache/jackrabbit","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0242.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16003","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/05/21/6","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/05/21/7","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-1833","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/21/6","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1833","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1833","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2015-05-29T15:00:00Z","modified":"2024-08-06T04:54:16.299Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2022-3268","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2015-05-29T15:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:13.664628Z"}],"ghsa":[{"id":"GHSA-9284-j4c9-779q","title":"Improper Input Validation in Apache Jackrabbit","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2022-05-14T02:49:30Z","modified":"2024-04-12T21:44:17Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:43.62603Z"}],"nvd":[{"id":"CVE-2015-1833","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2015-05-29T15:59:13.063Z","modified":"2026-06-17T00:23:05.087Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"CVE-2015-1833","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2015-05-29T15:59:13Z","modified":"2026-04-16T06:24:13.10031522Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1833","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2015-05-29T15:59:13.063Z","modified":"2026-09-09T06:47:18.497581166Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3298-1","title":"jackrabbit - security update","status":"published","published":"2015-07-01T00:00:00Z","modified":"2026-03-09T01:23:15.885021Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"GHSA-9284-j4c9-779q","title":"Improper Input Validation in Apache Jackrabbit","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2022-05-14T02:49:30Z","modified":"2024-12-04T05:41:09.21502Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"MGASA-2015-0242","title":"Updated jackrabbit packages fix CVE-2015-1833","description":"Updated jackrabbit packages fix security vulnerability:\n\nIn Apache Jackrabbit before 2.4.6, When processing a WebDAV request body\ncontaining XML, the XML parser can be instructed to read content from network\nresources accessible to the host, identified by URI schemes such as \"http(s)\"\nor  \"file\". Depending on the WebDAV request, this can not only be used to\ntrigger internal network requests, but might also be used to insert said\ncontent into the request, potentially exposing it to the attacker and others\n(for instance, by inserting said content in a WebDAV property value using a\nPROPPATCH request). See also IETF RFC 4918, Section 20.6 (CVE-2015-1833).\n","status":"published","published":"2015-06-08T21:17:51Z","modified":"2026-04-16T06:23:55.752205226Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-1833","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","status":"published","published":"2015-05-29T15:59:00Z","modified":"2025-07-16T07:32:42.201426Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}