Vulnerability details
CVE-2025-53689
Apache Software Foundation Apache Jackrabbit
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
CVSS 3.1
8.8High
Official description
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apache Software Foundation | Apache Jackrabbit | 2.20.0 ≤ v < 2.20.17 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache Jackrabbit | 2.22.0 ≤ v < 2.22.1 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache Jackrabbit | 2.23.0-beta ≤ v < 2.23.2-beta | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-07-14
- Last updated
- 2025-11-05
- State
- Published
- Assigner (CNA)
- apache
Exploit prediction (EPSS)
0.54%
Probability of exploitation in 30 days
45.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-611Improper Restriction of XML External Entity Reference