漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory
Vulnerability Description
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVSS Information
N/A
Vulnerability Type
可信数据的反序列化
Vulnerability Title
Apache Jackrabbit Core和Apache Jackrabbit JCR Commons 安全漏洞
Vulnerability Description
Apache Jackrabbit Core和Apache Jackrabbit JCR Commons都是Apache基金会的产品。Apache Jackrabbit Core是一个内容库核心。Apache Jackrabbit JCR Commons是一个通用工具库。 Apache Jackrabbit Core 1.0.0至2.22.1版本和Apache Jackrabbit JCR Commons 1.0.0至2.22.1版本存在安全漏洞，该漏洞源于反序列化不受信任数据，可能导致执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A