CVE-2015-1833
NoneCVSS
—
EPSS
55.9%
Published
May 29, 2015
CISA due date
—
The record
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.jackrabbit:jackrabbit-core | 0 | 2.0.6 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.10.0 | 2.10.1 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.2.0 | 2.2.14 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.4.0 | 2.4.6 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.6.0 | 2.6.6 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.8.0 | 2.8.1 |
| Debian:11 | jackrabbit | 0 | 2.10.1-1 |
| Debian:12 | jackrabbit | 0 | 2.10.1-1 |
| Debian:13 | jackrabbit | 0 | 2.10.1-1 |
| Debian:7 | jackrabbit | 0 | 2.3.6-1+deb7u1 |
| Debian:8 | jackrabbit | 0 | 2.3.6-1+deb8u1 |
| Mageia:4 | jackrabbit | 0 | 2.4.2-6.1.mga4 |
| Ubuntu:14.04:LTS | jackrabbit | 0 | 2.3.6-1+deb8u1build0.14.04.1 |
| maven | org.apache.jackrabbit/jackrabbit-core | 2.10.0 | No fix |
| maven | org.apache.jackrabbit/jackrabbit-core | 2.2.0 | No fix |
| maven | org.apache.jackrabbit/jackrabbit-core | 2.4.0 | No fix |
| maven | org.apache.jackrabbit/jackrabbit-core | 2.6.0 | No fix |
| maven | org.apache.jackrabbit/jackrabbit-core | 2.8.0 | No fix |
Related vulnerabilities
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20
- CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with a fast… CWE-20
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-20
- CVE-2026-105756 vLLM is an inference and serving engine for large language models. CWE-20