Critical, CVSS 9.8MavenPublished
Remote code execution in Apache Jackrabbit
CVE-2023-37895 · GHSA-q8cm-3v62-jj79
- Affected
- Maven org.apache.jackrabbit:jackrabbit-standalone-components >= 2.21.0, < 2.21.18; >= 1.0.0, < 2.20.11
- Fixed in
- 2.21.182.20.11· Vendor fix available
- Issue
- Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be…
Recommended action: Upgrade to 2.21.18 or 2.20.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.