CVE-2023-37895

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2023-37895

creationtimestamp| type| source ---|---|--- 2023-07-25 18:27:02+00:00| seen| https://t.me/cibsecurity/67247 2023-09-09 12:36:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8992 2023-09-24 08:35:03+00:00| published-proof-of-concept| https://t.me/CNArsenal/1092...

com.day.crx:crx-server-j2ee (>=2.3.4, <=2.3.6), io.inkstand:scribble (>=0.1.0, <=0.2.0) +3 more potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=1.5.0, <=2.20.10)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =1.5.0, =2.3.4, =0.1.0, =1.5.0, =2.19.2, =5.13.1, =5.20.4 Source cves: CVE-2023-37895 Source advisory: OSV:GHSA-Q8CM-3V62-JJ79...

org.apache.jackrabbit:jackrabbit-standalone-components (>=2.21.0, <=2.21.17) potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=2.21.0, <=2.21.17)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =2.21.0, =2.21.0, =2.21.17 Source cves: CVE-2023-37895 Source advisory: OSV:GHSA-Q8CM-3V62-JJ79...

com.day.crx:crx-server-j2ee (>=2.3.4, <=2.3.6), io.inkstand:scribble (>=0.1.0, <=0.2.0) +3 more potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=1.5.0, <=2.20.10)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =1.5.0, =2.3.4, =0.1.0, =1.5.0, =2.19.2, =5.13.1, =5.20.4 Source cves: CVE-2023-37895 Source advisory: GHSA-Q8CM-3V62-JJ79...

org.apache.jackrabbit:jackrabbit-standalone-components (>=2.21.0, <=2.21.17) potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=2.21.0, <=2.21.17)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =2.21.0, =2.21.0, =2.21.17 Source cves: CVE-2023-37895 Source advisory: GHSA-Q8CM-3V62-JJ79...

CVE-2023-37895

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2023-37895

Summary: CVE-2023-37895 affects Apache Jackrabbit Webapp/Standalone via an unsafe deserialization in the commons-beanutils component, enabling remote code execution over RMI. Affected RMIs include versions up to 2.20.10 (stable) and 2.21.17 (unstable). Impact: potential remote code execution with...

org.apache.jackrabbit:jackrabbit-standalone-components (>=2.21.0, <=2.21.17) potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=2.21.0, <=2.21.17)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =2.21.0, =2.21.0, =2.21.17 Source cves: CVE-2023-37895 Source advisory: MEND:CVE-2023-37895...

com.day.crx:crx-server-j2ee (>=2.3.4, <=2.3.6), io.inkstand:scribble (>=0.1.0, <=0.2.0) +3 more potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=1.5.0, <=2.20.10)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =1.5.0, =2.3.4, =0.1.0, =1.5.0, =2.19.2, =5.13.1, =5.20.4 Source cves: CVE-2023-37895 Source advisory: MEND:CVE-2023-37895...