
We found results for “”
CVE-2025-58782
Good to know:



Date: September 8, 2025
Deserialization of Untrusted Data vulnerability exists in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are advised to review their use of JNDI URI for JCR lookup.
Severity Score
Related Resources (7)
Severity Score
Weakness Type (CWE)
Deserialization of Untrusted Data
CWE-502Top Fix

Upgrade Version
Upgrade to version org.apache.jackrabbit:jackrabbit-jcr-commons:2.22.2;org.apache.jackrabbit:jackrabbit-core:2.22.2;org.apache.jackrabbit:jackrabbit-jcr-commons:2.22.2;https://github.com/apache/jackrabbit.git - jackrabbit-2.22.2
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | LOW |
Integrity (I): | LOW |
Availability (A): | NONE |