CVE-2015-1833
CVE-2015-1833
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Productos afectados
n/a · n/aPoCs públicas encontradas — 3
cve_referencepacketstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.htmlno verificadocve_referencewww.exploit-db.com/exploits/37110/no verificadoexploitdbwww.exploit-db.com/exploits/37110no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3Ehttp://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.htmlhttps://issues.apache.org/jira/browse/JCR-3883https://www.exploit-db.com/exploits/37110/http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txthttp://www.debian.org/security/2015/dsa-3298http://www.securityfocus.com/archive/1/535582/100/0/threadedhttp://www.securityfocus.com/bid/74761