{"answers":{"affected":"12 open source packages ship an affected version, including org.apache.jackrabbit:jackrabbit-standalone, org.apache.jackrabbit:jackrabbit-standalone-components and org.apache.jackrabbit:jackrabbit-webapp. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-37895 in the wild and no public exploit code.","fix":"Upgrade org.apache.jackrabbit:jackrabbit-standalone to a fixed version for your release line: 2.20.11 or 2.21.18.","what":"CVE-2023-37895 is a critical unsafe deserialization vulnerability in Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components), published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-37895 and fix it if it is affected.\n\nWhat it is: CVE-2023-37895 is a critical unsafe deserialization vulnerability in Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components), published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-37895 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.jackrabbit:jackrabbit-standalone (Maven): affected from 1.0.0; fixed in 2.20.11\n- org.apache.jackrabbit:jackrabbit-standalone (Maven): affected from 1.0.0; fixed in 2.20.11\n- org.apache.jackrabbit:jackrabbit-standalone (Maven): affected from 2.21.0; fixed in 2.21.18\n- org.apache.jackrabbit:jackrabbit-standalone (Maven): affected from 2.21.0; fixed in 2.21.18\n- org.apache.jackrabbit:jackrabbit-standalone-components (Maven): affected from 1.0.0; fixed in 2.20.11\n- org.apache.jackrabbit:jackrabbit-standalone-components (Maven): affected from 1.0.0; fixed in 2.20.11\n- org.apache.jackrabbit:jackrabbit-standalone-components (Maven): affected from 2.21.0; fixed in 2.21.18\n- org.apache.jackrabbit:jackrabbit-standalone-components (Maven): affected from 2.21.0; fixed in 2.21.18\n- org.apache.jackrabbit:jackrabbit-webapp (Maven): affected from 1.0.0; fixed in 2.20.11\n- org.apache.jackrabbit:jackrabbit-webapp (Maven): affected from 1.0.0; fixed in 2.20.11\n- org.apache.jackrabbit:jackrabbit-webapp (Maven): affected from 2.21.0; fixed in 2.21.18\n- org.apache.jackrabbit:jackrabbit-webapp (Maven): affected from 2.21.0; fixed in 2.21.18\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-37895/ (Markdown: https://insights.sbomify.com/CVE-2023-37895/index.md)","id":"CVE-2023-37895","markdown":"https://insights.sbomify.com/CVE-2023-37895/index.md","name":"CVE-2023-37895","record":{"aliases":["DEBIAN-CVE-2023-37895","GHSA-q8cm-3v62-jj79","UBUNTU-CVE-2023-37895"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Apache Jackrabbit","requires_auth":"none","summary":"Remote attackers can execute arbitrary code via unsafe Java deserialization in Apache Jackrabbit's RMI interface, requiring immediate upgrades or disabling RMI.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"jackrabbit","vendor":"apache"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"description":"Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component \"commons-beanutils\", which contains a class that can be used for remote code execution over RMI.\n\nUsers are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.\n\nIn general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.\n\nHow to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.\n\nThe native RMI protocol by default uses port 1099. To check whether it is enabled, tools like \"netstat\" can be used to check.\n\nRMI-over-HTTP in Jackrabbit by default uses the path \"/rmi\". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.\n\nTurning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:\n\n        \u003cservlet\u003e\n            \u003cservlet-name\u003eRMI\u003c/servlet-name\u003e\n            \u003cservlet-class\u003eorg.apache.jackrabbit.servlet.remote.RemoteBindingServlet\u003c/servlet-class\u003e\n        \u003c/servlet\u003e\n\n        \u003cservlet-mapping\u003e\n            \u003cservlet-name\u003eRMI\u003c/servlet-name\u003e\n            \u003curl-pattern\u003e/rmi\u003c/url-pattern\u003e\n        \u003c/servlet-mapping\u003e\n\nFind the bootstrap.properties file (in $REPOSITORY_HOME), and set\n\n         rmi.enabled=false\n\n    and also remove\n\n         rmi.host\n         rmi.port\n         rmi.url-pattern\n\n If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Jackrabbit RMI access can lead to RCE","id":"CVE-2023-37895","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"deserialization","year":"2023"},"n_packages":12,"n_references":4,"next":{"headline":"Nuclei Path Traversal vulnerability","id":"CVE-2023-37896"},"packages":[{"ecosystem":"Maven","fixed":["2.20.11"],"introduced":["1.0.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone","purl":null,"source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.20.11"],"introduced":["1.0.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-standalone","source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.21.18"],"introduced":["2.21.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone","purl":null,"source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.21.18"],"introduced":["2.21.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-standalone","source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.20.11"],"introduced":["1.0.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone-components","purl":null,"source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.20.11"],"introduced":["1.0.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone-components","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-standalone-components","source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.21.18"],"introduced":["2.21.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone-components","purl":null,"source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.21.18"],"introduced":["2.21.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-standalone-components","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-standalone-components","source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.20.11"],"introduced":["1.0.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-webapp","purl":null,"source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.20.11"],"introduced":["1.0.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-webapp","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webapp","source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.21.18"],"introduced":["2.21.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-webapp","purl":null,"source":"GHSA-q8cm-3v62-jj79"},{"ecosystem":"Maven","fixed":["2.21.18"],"introduced":["2.21.0"],"last_affected":[],"package":"org.apache.jackrabbit:jackrabbit-webapp","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webapp","source":"GHSA-q8cm-3v62-jj79"}],"prev":{"headline":"WordPress Variation Images Gallery for WooCommerce Plugin \u003c= 2.3.3 is vulnerable to Cross Site Scripting (XSS)","id":"CVE-2023-37894"},"products":["Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components)","Apache Jackrabbit Webapp (jackrabbit-webapp)"],"published":"2023-07-25","related":[{"cvss_score":9.3,"headline":"Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens","id":"CVE-2026-92414","kev_date_added":null,"published":"2026-10-07"},{"cvss_score":8.8,"headline":"Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons","id":"CVE-2025-53689","kev_date_added":null,"published":"2025-07-14"},{"cvss_score":8.8,"headline":"Apache Jackrabbit Authentication Hijacking Vulnerability","id":"CVE-2016-6801","kev_date_added":null,"published":"2016-09-21"},{"cvss_score":6.9,"headline":"Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies","id":"CVE-2026-92415","kev_date_added":null,"published":"2026-10-07"},{"cvss_score":6.5,"headline":"Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory","id":"CVE-2025-58782","kev_date_added":null,"published":"2025-09-08"},{"cvss_score":6.4,"headline":"Improper Input Validation in Apache Jackrabbit","id":"CVE-2015-1833","kev_date_added":null,"published":"2015-05-29"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-02-13","vendors":["Apache Software Foundation"]},"summary":"Remote attackers can execute arbitrary code via unsafe Java deserialization in Apache Jackrabbit's RMI interface, requiring immediate upgrades or disabling RMI.","url":"https://insights.sbomify.com/CVE-2023-37895/"}