← CVE Intelligence

CVE-2025-53689

Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons PUBLISHED

Description (CNA)

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache Jackrabbitaffected 2.20.0 before 2.20.17; affected 2.22.0 before 2.22.1; affected 2.23.0-beta before 2.23.2-beta

CWE

CWE-611

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.