CVE-2025-53689

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-53689", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-07-08T10:21:17.361Z", "datePublished": "2025-07-14T09:15:38.863Z", "dateUpdated": "2025-11-04T21:12:33.255Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "org.apache.jackrabbit:jackrabbit-spi-commons", "product": "Apache Jackrabbit", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.20.17", "status": "affected", "version": "2.20.0", "versionType": "maven"}, {"lessThan": "2.22.1", "status": "affected", "version": "2.22.0", "versionType": "maven"}, {"lessThan": "2.23.2-beta", "status": "affected", "version": "2.23.0-beta", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Lars Krapf - Adobe"}, {"lang": "en", "type": "finder", "value": "Dylan Pindur - Assetnote"}, {"lang": "en", "type": "finder", "value": "Adam Kues - Assetnote"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit &lt; 2.23.2 due to usage of an unsecured document build to load privileges.<br><br>Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version."}], "value": "Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.\n\nUsers are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version."}], "metrics": [{"other": {"content": {"text": "critical"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-07-14T09:15:38.863Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-14T15:45:32.467940Z", "id": "CVE-2025-53689", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-14T15:46:20.206Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/07/14/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:12:33.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/07/14/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:12:33.255Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-53689", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-14T15:45:32.467940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-14T15:45:46.499Z"}}], "cna": {"title": "Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Lars Krapf - Adobe"}, {"lang": "en", "type": "finder", "value": "Dylan Pindur - Assetnote"}, {"lang": "en", "type": "finder", "value": "Adam Kues - Assetnote"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Jackrabbit", "versions": [{"status": "affected", "version": "2.20.0", "lessThan": "2.20.17", "versionType": "maven"}, {"status": "affected", "version": "2.22.0", "lessThan": "2.22.1", "versionType": "maven"}, {"status": "affected", "version": "2.23.0-beta", "lessThan": "2.23.2-beta", "versionType": "maven"}], "packageName": "org.apache.jackrabbit:jackrabbit-spi-commons", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.\n\nUsers are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.", "supportingMedia": [{"type": "text/html", "value": "Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit &lt; 2.23.2 due to usage of an unsecured document build to load privileges.<br><br>Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-07-14T09:15:38.863Z"}}}, "cveMetadata": {"cveId": "CVE-2025-53689", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:12:33.255Z", "dateReserved": "2025-07-08T10:21:17.361Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-07-14T09:15:38.863Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "org.apache.jackrabbit:jackrabbit-spi-commons", "product": "Apache Jackrabbit", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.20.17", "status": "affected", "version": "2.20.0", "versionType": "maven"}, {"lessThan": "2.22.1", "status": "affected", "version": "2.22.0", "versionType": "maven"}, {"lessThan": "2.23.2-beta", "status": "affected", "version": "2.23.0-beta", "versionType": "maven"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "matchCriteriaId": "D46FDED7-5B8A-4439-B5C9-A4A7C8AD364E", "versionEndExcluding": "2.20.17", "versionStartIncluding": "2.20.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:jackrabbit:2.22.0:*:*:*:*:*:*:*", "matchCriteriaId": "391DCFCA-4A56-47B8-BE4E-9B218949B029", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:jackrabbit:2.23.0:beta:*:*:*:*:*:*", "matchCriteriaId": "1D89D873-60D1-4B52-8E5B-1B07FFC8FB36", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:jackrabbit:2.23.1:beta:*:*:*:*:*:*", "matchCriteriaId": "A7D1330F-1055-4CA6-A5E8-0A841FF29978", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.\n\nUsers are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version."}, {"lang": "es", "value": "Vulnerabilidades Blind XXE en jackrabbit-spi-commons y jackrabbit-core en Apache Jackrabbit anterior a la versi\u00f3n 2.23.2 debido al uso de una compilaci\u00f3n de documento no segura para cargar privilegios. Se recomienda a los usuarios actualizar a las versiones 2.20.17 (Java 8), 2.22.1 (Java 11) o 2.23.2 (Java 11, versiones beta), que solucionan este problema. Las versiones anteriores (hasta la 2.20.16) ya no son compatibles, por lo que los usuarios deben actualizar a la versi\u00f3n compatible correspondiente."}], "id": "CVE-2025-53689", "lastModified": "2026-06-17T09:38:42.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53689", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-14T15:45:32.467940Z", "version": "2.0.3"}}]}, "published": "2025-07-14T10:15:28.587", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/07/14/1"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "jackrabbit-spi-commons: jackrabbit-core: Apache Jackrabbit XXE vulnerability", "id": "2379885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379885"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-611", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-53689", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "jackrabbit-core", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "jackrabbit-spi-commons", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "jackrabbit-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "jackrabbit-spi-commons", "product_name": "Red Hat Fuse 7"}], "public_date": "2025-07-14T09:15:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-53689\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-53689\nhttps://github.com/apache/jackrabbit/commit/410d708595750528095db1a2accc95356ddf7311\nhttps://issues.apache.org/jira/browse/JCR-5165\nhttps://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24"], "threat_severity": "Important"}

{}