Unscored severity · published May 29, 2015
CVE-2015-1833
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before…
–
CVSS
55.9%
EPSS
No
On KEV
Description
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Exploitation
Is it being used?
Exploit prediction (EPSS)55.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jackrabbit · Apache
through 2.0.5; 2.2.0; 2.2.1; 2.2.2; 2.2.4; 2.2.5; +21 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1833
Vendor Advisory
http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E
packetstormsecurity.com
http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html
Vendor Advisory
http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt
www.debian.org
http://www.debian.org/security/2015/dsa-3298
www.securityfocus.com
http://www.securityfocus.com/archive/1/535582/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/74761
More from Jackrabbit
9.8
CVE-2023-37895
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable…
9.1
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
8.8
CVE-2025-53689
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges
8.8
CVE-2016-6801
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before…
6.5
CVE-2025-58782
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons