6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58782

CVE-2025-58782: Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58782

CVE-2025-58782:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.jackrabbit:jackrabbit-core	maven	>= 1.0.0, < 2.22.2	2.22.2
org.apache.jackrabbit:jackrabbit-jcr-commons	maven	>= 1.0.0, < 2.22.2	2.22.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability described is a classic JNDI injection issue within Apache Jackrabbit's JCR Commons component. The root cause is the deserialization of untrusted data when the application processes a malicious JNDI URI. By analyzing the provided patch from the pull request, I was able to pinpoint the exact location of the vulnerability.

The commit 33f2068b030a22e5e826701ea0175cbf6a895968 clearly shows the modification in the JNDIRepositoryFactory.java file. The getRepository method was previously performing a JNDI lookup (context.lookup(name)) without any safeguards. This is the entry point for the vulnerability, as an attacker-controlled name could be a URL pointing to a malicious RMI server, leading to remote code execution.

The fix introduces a system property jackrabbit.jndi.enabled which is set to false by default. The JNDI lookup is now wrapped in a conditional block that only executes if this property is explicitly set to true. This effectively disables the vulnerable functionality by default, requiring administrators to consciously enable it, thus mitigating the risk for the majority of users.

Therefore, the primary vulnerable function is org.apache.jackrabbit.commons.repository.JNDIRepositoryFactory.getRepository, as it is the function that directly interacts with the JNDI context and performs the unsafe lookup.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.