CVE-2015-1833

2015-05-2900:00:00

ubuntu.com

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.019 Low

EPSS

Percentile

88.6%

JSON

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6,
2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before
2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary
files and send requests to intranet servers via a crafted WebDAV request.

Notes

Author	Note
sbeattie	package only contains webdav module; however, vuln affects webdav module

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchjackrabbit< 2.3.6-1+deb8u1build0.14.04.1UNKNOWN
ubuntu14.10noarchjackrabbit< 2.3.6-1+deb8u1build0.14.10.1UNKNOWN
ubuntu15.04noarchjackrabbit< 2.3.6-1+deb8u1build0.15.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	jackrabbit	< 2.3.6-1+deb8u1build0.14.04.1	UNKNOWN
ubuntu	14.10	noarch	jackrabbit	< 2.3.6-1+deb8u1build0.14.10.1	UNKNOWN
ubuntu	15.04	noarch	jackrabbit	< 2.3.6-1+deb8u1build0.15.04.1	UNKNOWN