CVE-2025-53689: Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Description

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 45% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AJ

Apache Jackrabbit · Apache Software Foundation

2.20.0 before 2.20.17; 2.22.0 before 2.22.1; 2.23.0-beta before 2.23.2-beta · source: vendor

JA

Jackrabbit · Apache

2.20.0 before 2.20.17; 2.22.0; 2.23.0; 2.23.1 · source: NVD