cveboard RSS feed

CVE-2025-58782

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Apache Jackrabbit Core

Vendor
Apache Software Foundation
Product
Apache Jackrabbit Core
Platforms
Unknown
Default status
unaffected
Package
org.apache.jackrabbit:jackrabbit-core
Package collection
https://repo.maven.apache.org/maven2
Apache Jackrabbit Core · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.0.0affectedsemverUnavailable2.22.1None listed

Apache Jackrabbit JCR Commons

Vendor
Apache Software Foundation
Product
Apache Jackrabbit JCR Commons
Platforms
Unknown
Default status
unaffected
Package
org.apache.jackrabbit:jackrabbit-jcr-commons
Package collection
https://repo.maven.apache.org/maven2
Apache Jackrabbit JCR Commons · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.0.0affectedsemverUnavailable2.22.1None listed