GitHub Advisoryadvisory · Maven

GHSA-44c3-38h8-9fh9 Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build

HIGH Published 2025-07-14 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53689
Ecosystem
Maven
Packages
org.apache.jackrabbit:jackrabbit-spi-commons, org.apache.jackrabbit:jackrabbit-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2025-07-14

Affected packages

• Maven org.apache.jackrabbit:jackrabbit-spi-commons: >= 2.20.0, < 2.20.17 → fixed in 2.20.17 • Maven org.apache.jackrabbit:jackrabbit-spi-commons: >= 2.22.0, < 2.22.1 → fixed in 2.22.1 • Maven org.apache.jackrabbit:jackrabbit-spi-commons: >= 2.23.0-beta, < 2.23.2-beta → fixed in 2.23.2-beta • Maven org.apache.jackrabbit:jackrabbit-core: >= 2.23.0-beta, < 2.23.2-beta → fixed in 2.23.2-beta • Maven org.apache.jackrabbit:jackrabbit-core: >= 2.20.0, < 2.20.17 → fixed in 2.20.17 • Maven org.apache.jackrabbit:jackrabbit-core: >= 2.22.0, < 2.22.1 → fixed in 2.22.1

Description

Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Related

Alias · CVE (1)

  • CVE-2025-53689 Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References