XXE (XML External Entity Injection) org.apache.jackrabbit:jackrabbit-spi-commons Dependency in Confluence Data Center and Server

This High severity XXE XML External Entity Injection vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H allows an...

com.adobe.granite:com.adobe.granite.testing.external-systems (0.0.3), com.adobe.granite:com.adobe.granite.testing.granite-it-framework (1.0.36) +30 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (2.22.0)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-spi-commons and may be impacted: - com.adobe.granite:com.adobe.granite.testing.external-systems 0.0.3 -...

com.adobe.granite:com.adobe.granite.testing.external-systems (0.0.3), com.adobe.granite:com.adobe.granite.testing.granite-it-framework (1.0.36) +30 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (2.22.0)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-spi-commons and may be impacted: - com.adobe.granite:com.adobe.granite.testing.external-systems 0.0.3 -...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.3.0) +50 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.20.0, <=2.20.16)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.6, =1.4.20, =1.3, =1.3, =1.11.0, =1.11.0, =1.11.0, =2.24.0 and more Source cves: CVE-2025-53689 Source advisory: OSV:GH...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: OSV:GHSA-44C3-38H8-9FH9...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: GHSA-44C3-38H8-9FH9...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the use of an unsecured document to load privileges. An attacker can execute arbitrary code or cause a denial of service by submitting specially crafted XML data. Details XXE Injection is a type ...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.3.0) +50 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.20.0, <=2.20.16)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.6, =1.4.20, =1.3, =1.3, =1.11.0, =1.11.0, =1.11.0, =2.24.0 and more Source cves: CVE-2025-53689 Source advisory: GHSA-4...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory:...

DEBIAN-CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

UBUNTU-CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: MEND:CVE-2025-53689...

com.adobe.granite:com.adobe.granite.testing.external-systems (0.0.3), com.adobe.granite:com.adobe.granite.testing.granite-it-framework (1.0.36) +30 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (2.22.0)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-spi-commons and may be impacted: - com.adobe.granite:com.adobe.granite.testing.external-systems 0.0.3 -...

CVE-2025-53689: Improper Restriction of XML External Entity Reference

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

Apache Jackrabbit security vulnerabilities

Apache Jackrabbit is a content repository from Apache Corporation USA. A security vulnerability exists in Apache Jackrabbit versions prior to 2.23.2, which stems from a blind XXE vulnerability in jackrabbit-spi-commons and jackrabbit-core...