Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN980
_____________________________________________________________________

DATE                : 07/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Jackrabbit versions
                            prior to 2.23.6, 2.22.5, 2.20.18.
  
====================================================================
https://lists.apache.org/thread.html/zwrfv0xjgfjsclxs22hp1f238wk0s74n
https://lists.apache.org/thread.html/ctc7mxprh271y3g2q7ckx6os63jq4nq2
_____________________________________________________________________

CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions
via derivable WebDAV lock tokens

Severity: 
    CVSS 4.0: 9.3 (critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N


Affected versions:

- Apache Jackrabbit 2.23.0 through 2.23.5
- Apache Jackrabbit 2.22.0 through 2.22.4
- Apache Jackrabbit 2.20.0 through 2.20.17


Description:

: Session Fixation / Session Reuse across Users vulnerability in Apache
Jackrabbit.



Jackrabbit WebDAV server attaches a cached authenticated session on
any Lock-Token/TransactionId/SubscriptionId/If-header field token
match with

no credential check.


This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5,
from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.


Users are recommended to upgrade to versions 2.23.6, 2.22.5, or
2.20.18 which fix the issue.


Credit:

The Apache Software Foundation (finder)
Julian Reschke (analyst)
Claude Security (tool)


References:

https://jackrabbit.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-92414

_____________________________________________________________________

CVE-2026-92415: Apache Jackrabbit: DavEx client runs
Class.forName + (String)-constructor on server-controlled error bodies

Severity: 
    CVSS 4.0: 6.9 (medium) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/S:N


Affected versions:

- Apache Jackrabbit 2.23.0 through 2.23.5
- Apache Jackrabbit 2.22.0 through 2.22.4
- Apache Jackrabbit 2.20.0 through 2.20.17


Description:

— Use of Externally-Controlled Input to Select Classes or Code
vulnerability in Apache Jackrabbit's WebDAV/Davex client.

A malicious WebDAV/DavEx server, or an attacker able to intercept the
connection, can cause the client to instantiate arbitrary classes from
its classpath, which can lead to arbitrary file creation or truncation.

Only applications that use jackrabbit-spi2dav (directly or through
jackrabbit-jcr2dav) to connect to a remote repository are affected.
Jackrabbit servers are not affected.

Category: unsafe reflection on wire data (HIGH).


This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5,
from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.


Users are recommended to upgrade to versions 2.23.6, 2.22.5, or
2.20.18 which fix the issue.


Credit:

The Apache Software Foundation (finder)
Julian Reschke (analyst)
Claude Security (tool)


References:

https://jackrabbit.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-92415



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================