Riskcovery

CVE-2025-58782

Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

State
Published
Severity
6.5 Medium
Published
Sep 8, 2025
Updated
Nov 4, 2025
Reserved
Sep 5, 2025

Read the record on cve.org

Description

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCISA-ADP

Weaknesses

  • CWE-502 Deserialization of Untrusted Data

Affected Products

ProductVersions
Apache Jackrabbit CoreApache Software Foundation
  • 1.0.0 through 2.22.1Affected
Apache Jackrabbit JCR CommonsApache Software Foundation
  • 1.0.0 through 2.22.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.