Threats tagged 'ghsa-44c3-38h8-9fh9'

Apache Jackrabbit versions prior to 2.20.17, 2.22.1, and 2.23.2-beta contain a blind XML External Entity (XXE) vulnerability in the jackrabbit-spi-commons and jackrabbit-core components. This vulnerability arises from the use of an insecure document builder to load privileges. It allows an attacker with low privileges to cause high impact including confidentiality, integrity, and availability compromise. Users are advised to upgrade to the fixed versions to mitigate this issue.