Vulnerability record · CVE-2015-1833 · published 29 May 2015
CVE-2015-1833: Apache Jackrabbit WebDAV XXE allows file read and SSRF
Apache · Jackrabbit
Apache Jackrabbit fails to properly restrict XML external entity processing in WebDAV requests, allowing crafted XML to resolve external entities. This lets a remote attacker read arbitrary files on the server and make requests to intranet servers. The flaw affects multiple Jackrabbit release branches before their fixed versions.
Description
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
AV:N/AC:L/Au:N/C:P/I:P/A:N
Automated analysis
high priorityUnauthenticated remote XXE with public exploit code and very high EPSS, though CVSS v2 rates it only medium severity.
What it is
Apache Jackrabbit fails to properly restrict XML external entity processing in WebDAV requests, allowing crafted XML to resolve external entities. This lets a remote attacker read arbitrary files on the server and make requests to intranet servers. The flaw affects multiple Jackrabbit release branches before their fixed versions.
Impact
An attacker can read arbitrary files accessible to the Jackrabbit process and use the server as a proxy to reach internal network services. This exposes sensitive configuration, credentials, and internal-only endpoints.
Attack surface
Reached remotely over the network via a crafted WebDAV request; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
No CISA KEV listing, but EPSS is high (0.55, ~99th percentile) and a public Exploit-DB entry (37110) exists, indicating exploit code is available.
What to do
- Upgrade to a fixed Jackrabbit release: 2.0.6, 2.2.14, 2.4.6, 2.6.6, 2.8.1, or 2.10.1 (or later).
- Disable external entity resolution in the XML parser used for WebDAV processing.
- Restrict outbound network access from Jackrabbit hosts to limit SSRF reach into intranet services.
- If WebDAV is not required, disable or block the WebDAV endpoint at the reverse proxy or firewall.
Detection
- Inspect WebDAV request bodies for DOCTYPE declarations or SYSTEM/PUBLIC external entity references.
- Monitor Jackrabbit server logs for XML parse errors and unexpected file access patterns.
- Alert on outbound HTTP requests from Jackrabbit hosts to internal-only addresses or unusual ports.
- Review file access auditing for reads of sensitive files by the Jackrabbit process account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-1833 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-1833), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
