CVE-2015-1833

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 51%

from disclosure to weapon0 days

Published on NVDMay 29

1st PoCMay 26

exploitation probability

51%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/37110/unverified exploitdbwww.exploit-db.com/exploits/37110unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html https://issues.apache.org/jira/browse/JCR-3883 https://www.exploit-db.com/exploits/37110/http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt http://www.debian.org/security/2015/dsa-3298 http://www.securityfocus.com/archive/1/535582/100/0/threaded http://www.securityfocus.com/bid/74761