CVE-2026-92415

Estado: AnalizadaMedia (6.9)—

— Vulnerabilidad de uso de entrada controlada externamente para seleccionar clases o código en el cliente WebDAV/Davex de Apache Jackrabbit.

Un servidor WebDAV/DavEx malicioso, o un atacante capaz de interceptar la conexión, puede hacer que el cliente instancie clases arbitrarias de su classpath, lo que puede provocar la creación o el truncamiento arbitrario de archivos.

Solo se ven afectadas las aplicaciones que usan jackrabbit-spi2dav (directamente o a través de jackrabbit-jcr2dav) para conectarse a un repositorio remoto. Los servidores Jackrabbit no están afectados.

Categoría: reflexión insegura sobre datos recibidos por la red (ALTA).

Leer descripción completaMostrar menos

Este problema afecta a Apache Jackrabbit: desde la 2.23.0 hasta la 2.23.5, desde la 2.22.0 hasta la 2.22.4, desde la 2.20.0 hasta la 2.20.17.

Se recomienda a los usuarios actualizar a las versiones 2.23.6, 2.22.5 o 2.20.18, que corrigen el problema.

Traducción automática del texto original de NVD (en inglés).

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 6.9

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.55%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 15/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1059 Command and Scripting Interpreterexecution75 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact70 %

AV:N/PR:N permite explotación remota sin autenticación (T1190). La instantiación de clases arbitrarias desde classpath permite ejecución de código (T1059) y manipulación de archivos (T1565.001, creación/truncado).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Restrict File and Directory Permissions Remote Data Storage Network Segmentation

Tecnologías afectadas (1)

Apache — Jackrabbit

CWE

CWE-470

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-92415",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-92415",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T20:29:38.090473Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "Safety": "NEGLIGIBLE",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Jackrabbit",
          "versions": [
            {
              "status": "affected",
              "version": "2.23.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.23.5"
            },
            {
              "status": "affected",
              "version": "2.22.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.22.4"
            },
            {
              "status": "affected",
              "version": "2.20.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.20.17"
            }
          ],
          "packageURL": "pkg:maven/org.apache.jackrabbit/jackrabbit-spi2dav",
          "packageName": "org.apache.jackrabbit:jackrabbit-spi2dav",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-07T16:19:13.070",
  "references": [
    {
      "url": "https://lists.apache.org/thread.html/hcrxm4jp1mtk56xb8p1dtryz7hl08kmr",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/07/28",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client.\n\nA malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.\n\nOnly applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected.\n\nCategory: unsafe reflection on wire data (HIGH).\n\n\n\nThis issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.\n\n\n\nUsers are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue."
    }
  ],
  "lastModified": "2026-10-13T14:24:47.540",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED33B3AA-CC33-415A-9B7D-3AEA9E13996D",
              "versionEndExcluding": "2.20.18",
              "versionStartIncluding": "2.20.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC45EF0E-2A77-4858-866D-1FE0E7C19241",
              "versionEndExcluding": "2.22.5",
              "versionStartIncluding": "2.22.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9376FC7D-3C7E-4147-96FF-D63A7AAF2C60",
              "versionEndExcluding": "2.23.6",
              "versionStartIncluding": "2.23.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}