Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.jackrabbit:jackrabbit-webapp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    Remote code execution in Apache Jackrabbit

    CVE-2023-37895 · GHSA-q8cm-3v62-jj79

    Affected
    • Maven org.apache.jackrabbit:jackrabbit-webapp >= 2.21.0, < 2.21.18; >= 1.0.0, < 2.20.11
    Fixed in
    2.21.182.20.11· Vendor fix available
    Issue
    Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be…

    Recommended action: Upgrade to 2.21.18 or 2.20.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →