CVE-2025-58782

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/09/06/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de deserialización de datos no confiables en Apache Jackrabbit Core y Apache Jackrabbit JCR Commons. Este problema afecta a Apache Jackrabbit Core: desde 1.0.0 hasta 2.22.1; Apache Jackrabbit JCR Commons: desde 1.0.0 hasta 2.22.1. Las implementaciones que aceptan URIs JNDI para búsquedas JCR de usuarios no confiables les permite inyectar referencias JNDI maliciosas, lo que podría conducir a ejecución de código arbitrario a través de la deserialización de datos no confiables. Se recomienda a los usuarios actualizar a la versión 2.22.2. La búsqueda JCR a través de JNDI ha sido deshabilitada por defecto en 2.22.2. Los usuarios de esta característica necesitan habilitarla explícitamente y se les aconseja revisar su uso de URIs JNDI para búsquedas JCR.

Information

Published : 2025-09-08 09:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-58782

Mitre link : CVE-2025-58782

CVE.ORG link : CVE-2025-58782

JSON object : View

Products Affected

apache

jackrabbit

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-58782", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58782", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T19:54:59.077889Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Jackrabbit Core", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "2.22.1"}], "packageName": "org.apache.jackrabbit:jackrabbit-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Jackrabbit JCR Commons", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "2.22.1"}], "packageName": "org.apache.jackrabbit:jackrabbit-jcr-commons", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2025-09-08T09:15:30.367", "references": [{"url": "https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/06/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.\n\nThis issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.\n\nDeployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data.\nUsers are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup."}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables en Apache Jackrabbit Core y Apache Jackrabbit JCR Commons.\n\nEste problema afecta a Apache Jackrabbit Core: desde 1.0.0 hasta 2.22.1; Apache Jackrabbit JCR Commons: desde 1.0.0 hasta 2.22.1.\n\nLas implementaciones que aceptan URIs JNDI para b\u00fasquedas JCR de usuarios no confiables les permite inyectar referencias JNDI maliciosas, lo que podr\u00eda conducir a ejecuci\u00f3n de c\u00f3digo arbitrario a trav\u00e9s de la deserializaci\u00f3n de datos no confiables.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.22.2. La b\u00fasqueda JCR a trav\u00e9s de JNDI ha sido deshabilitada por defecto en 2.22.2. Los usuarios de esta caracter\u00edstica necesitan habilitarla expl\u00edcitamente y se les aconseja revisar su uso de URIs JNDI para b\u00fasquedas JCR."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AD40389-2C1F-4C5D-B443-0400AE863BC7", "versionEndExcluding": "2.22.2", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}