CVE-2015-1833 Improper Input Validation in Apache Jackrabbit

What is CVE-2015-1833?

CVE-2015-1833 is a medium-severity vulnerability in n/a, published on 29 May 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.

Weakness: CWE-20

Which versions are affected by CVE-2015-1833?

12 open source packages ship an affected version, including org.apache.jackrabbit:jackrabbit-core. It affects 1 product.

Products include Apache Jackrabbit.

How do I fix CVE-2015-1833?

Upgrade org.apache.jackrabbit:jackrabbit-core to a fixed version for your release line: 2.0.6, 2.10.1, 2.2.14 or 2.4.6.

Is CVE-2015-1833 being exploited?

There is no known exploitation of CVE-2015-1833 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE Critical 9.8
• CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Critical 9.3
• CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons High 8.8
• CVE-2016-6801 Apache Jackrabbit Authentication Hijacking Vulnerability High 8.8
• CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-1833, DSA-3298-1, GHSA-9284-j4c9-779q, MGASA-2015-0242, UBUNTU-CVE-2015-1833.