CVE-2015-1833

Exp

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.

Published: 2015-05-29 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2015-1833

EPSS CVSS CWE GHSA Exploit-DB Affected OS Tracker

Conclusion & alert: CVE-2015-1833 is rated High Exploit Risk (80.2/100): CVSS Medium severity, with high exploitation likelihood (EPSS 51.49%, 99th percentile). Core evidence: 2 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +20.45% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2015-1833

EDB-ID	Source	Kind	Published	Link
37110	exploit_db	edb	2015-05-26	Exploit-DB ↗
—	nvd_ref	exploit_tag		Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2015-1833

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	31.03%	51.49%	+20.45%
2	2026-03-13	36.36%	31.03%	-5.33%
3	2026-03-04	—	36.36%	—

Full EPSS history (36 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2015-1833

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.4	2.0	MEDIUM	`AV:N/AC:L/Au:N/C:P/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	10.0	4.9	[email protected]

Weakness enumeration for CVE-2015-1833

CWE-20 MITRE ↗

GitHub Security Advisory for CVE-2015-1833

GHSA-9284-j4c9-779q · Severity: medium · Ecosystem: maven — Improper Input Validation in Apache Jackrabbit

OS Trackers for CVE-2015-1833

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2015-1833 not yet assigned priority: Debian including 1 source packages (jackrabbit), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2015-1833
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2015-1833
`ubuntu`	medium	CVE-2015-1833 medium priority: Ubuntu including 1 source packages (jackrabbit), 5 status rows across 5 suites (precise, trusty, upstream, utopic, vivid): released 4, DNE 1.	https://ubuntu.com/security/CVE-2015-1833

Affected software / configurations for CVE-2015-1833

Vendor	Product	Version	Raw CPE
apache	jackrabbit	<= 2.0.5	cpe:2.3:a:apache:jackrabbit::::::::
apache	jackrabbit	2.2.0	cpe:2.3:a:apache:jackrabbit:2.2.0:::::::*
apache	jackrabbit	2.2.1	cpe:2.3:a:apache:jackrabbit:2.2.1:::::::*
apache	jackrabbit	2.2.2	cpe:2.3:a:apache:jackrabbit:2.2.2:::::::*
apache	jackrabbit	2.2.4	cpe:2.3:a:apache:jackrabbit:2.2.4:::::::*
apache	jackrabbit	2.2.5	cpe:2.3:a:apache:jackrabbit:2.2.5:::::::*
apache	jackrabbit	2.2.7	cpe:2.3:a:apache:jackrabbit:2.2.7:::::::*
apache	jackrabbit	2.2.8	cpe:2.3:a:apache:jackrabbit:2.2.8:::::::*
apache	jackrabbit	2.2.9	cpe:2.3:a:apache:jackrabbit:2.2.9:::::::*
apache	jackrabbit	2.2.10	cpe:2.3:a:apache:jackrabbit:2.2.10:::::::*
apache	jackrabbit	2.2.11	cpe:2.3:a:apache:jackrabbit:2.2.11:::::::*
apache	jackrabbit	2.2.12	cpe:2.3:a:apache:jackrabbit:2.2.12:::::::*
apache	jackrabbit	2.2.13	cpe:2.3:a:apache:jackrabbit:2.2.13:::::::*
apache	jackrabbit	2.4.0	cpe:2.3:a:apache:jackrabbit:2.4.0:::::::*
apache	jackrabbit	2.4.1	cpe:2.3:a:apache:jackrabbit:2.4.1:::::::*
apache	jackrabbit	2.4.2	cpe:2.3:a:apache:jackrabbit:2.4.2:::::::*
apache	jackrabbit	2.4.3	cpe:2.3:a:apache:jackrabbit:2.4.3:::::::*
apache	jackrabbit	2.4.4	cpe:2.3:a:apache:jackrabbit:2.4.4:::::::*
apache	jackrabbit	2.4.5	cpe:2.3:a:apache:jackrabbit:2.4.5:::::::*
apache	jackrabbit	2.6.0	cpe:2.3:a:apache:jackrabbit:2.6.0:::::::*
apache	jackrabbit	2.6.1	cpe:2.3:a:apache:jackrabbit:2.6.1:::::::*
apache	jackrabbit	2.6.2	cpe:2.3:a:apache:jackrabbit:2.6.2:::::::*
apache	jackrabbit	2.6.3	cpe:2.3:a:apache:jackrabbit:2.6.3:::::::*
apache	jackrabbit	2.6.4	cpe:2.3:a:apache:jackrabbit:2.6.4:::::::*
apache	jackrabbit	2.6.5	cpe:2.3:a:apache:jackrabbit:2.6.5:::::::*
apache	jackrabbit	2.8.0	cpe:2.3:a:apache:jackrabbit:2.8.0:::::::*
apache	jackrabbit	2.10.0	cpe:2.3:a:apache:jackrabbit:2.10.0:::::::*

References for CVE-2015-1833

URL	Tags
http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E	Vendor Advisory
http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html
http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt	Vendor Advisory
http://www.debian.org/security/2015/dsa-3298
http://www.securityfocus.com/archive/1/535582/100/0/threaded
http://www.securityfocus.com/bid/74761
https://issues.apache.org/jira/browse/JCR-3883	Vendor Advisory
https://www.exploit-db.com/exploits/37110/	Exploit

cvelogic Threat Intelligence