CVE-2025-53689

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-53689
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-53689.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-53689
Aliases
Downstream
Published
2025-07-14T10:15:28Z
Modified
2025-07-29T16:45:34.204769Z
Summary
[none]
Details

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.

Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

References

Affected packages

Debian:11 / jackrabbit

Package

Name
jackrabbit
Purl
pkg:deb/debian/jackrabbit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.18.0+r2.14.6-1
2.20.3-1
2.20.11-1
2.20.11-1.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / jackrabbit

Package

Name
jackrabbit
Purl
pkg:deb/debian/jackrabbit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.20.3-1
2.20.11-1
2.20.11-1.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / jackrabbit

Package

Name
jackrabbit
Purl
pkg:deb/debian/jackrabbit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.20.11-1.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}