Threats tagged 'ghsa-cxvc-g8f2-4gmm'

Apache Jackrabbit Core and JCR Commons versions from 1.0.0 up to 2.22.1 are vulnerable to deserialization of untrusted data via JNDI URI lookups. This vulnerability allows attackers who can supply JNDI URIs to inject malicious references, potentially leading to arbitrary code execution. The issue is fixed in version 2.22.2, where JCR lookup through JNDI is disabled by default. Users relying on this feature must explicitly enable it and carefully review their usage.