PT-2025-36440 · Apache · Apache Jackrabbit

James John · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-58782

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions:

Apache Jackrabbit (affected versions not specified)

Description:

A vulnerability in Apache Jackrabbit exposes systems to JNDI injection, potentially leading to remote code execution.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-58782

Affected Products

Apache Jackrabbit

References · 10

• https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58782 · Security Note
• https://t.me/pentestingnews/67676 · Telegram Post
• https://t.me/cveNotify/134601 · Telegram Post
• https://twitter.com/freedomhack101/status/1965068188573647323 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/1964936786007703942 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1964877584292106325 · Twitter Post
• https://twitter.com/fridaysecurity/status/1964876957897904216 · Twitter Post
• https://twitter.com/CVEnew/status/1964981605459505606 · Twitter Post
• https://twitter.com/offseq/status/1964999818100576396 · Twitter Post