← back
CVE-2015-1833

CVE-2015-1833

EPSS 51.5%
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.htmlunverifiedcve_referencewww.exploit-db.com/exploits/37110/unverifiedexploitdbwww.exploit-db.com/exploits/37110unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3Ehttp://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.htmlhttps://issues.apache.org/jira/browse/JCR-3883https://www.exploit-db.com/exploits/37110/http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txthttp://www.debian.org/security/2015/dsa-3298http://www.securityfocus.com/archive/1/535582/100/0/threadedhttp://www.securityfocus.com/bid/74761