PT-2025-29446 · Apache+2 · Apache Jackrabbit+2

Adam Kues + 2 · Published 2025-07-14 · Updated 2026-01-20 · CVE-2025-53689

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions prior to 2.23.2

Description: The software contains Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core due to the use of an unsecured document build to load privileges.

Recommendations: Upgrade to version 2.20.17 (Java 8). Upgrade to version 2.22.1 (Java 11). Upgrade to version 2.23.2 (Java 11, beta versions).

Fix

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-53689

GHSA-44C3-38H8-9FH9

Affected Products

Apache Jackrabbit

Confluence

Debian

References · 23

• https://osv.dev/vulnerability/GHSA-44c3-38h8-9fh9 · Vendor Advisory
• https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-53689 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53689 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53689 · Security Note
• https://ubuntu.com/security/CVE-2025-53689 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-53689 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53689 · Security Note
• https://github.com/apache/jackrabbit · Note
• https://github.com/apache/jackrabbit/pull/263/commits/02786c0a01838580252bdab79bfa54026c30294e · Note
• https://twitter.com/CVEnew/status/1944695887873126664 · Twitter Post
• https://t.me/pentestingnews/64431 · Telegram Post
• https://twitter.com/oss_security/status/1947739443760402917 · Twitter Post