CVE-2023-37895
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-37895 is a Java object deserialization vulnerability affecting Jackrabbit webapp/standalone versions up to 2.20.10 (stable branch) and 2.21.17 (unstable branch). The issue lies in the use of the "commons-beanutils" component which can be exploited over RMI for remote code execution. To mitigate this risk, users are advised to update to versions 2.20.11 or 2.21.18. However, as RMI support can expose vulnerabilities, it is recommended to disable it altogether. RMI support in Jackrabbit can be checked on an RMI-specific TCP port (default 1099) or over HTTP (default path "/rmi"). To disable it, web.xml in the JAR/WAR file or unpacked web application folder should be modified, and the bootstrap.properties file should have "rmi.enabled=false" set and related variables removed.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Apache Jackrabbit
Affected Vendors
- Apache Software Foundation
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions