How severe is CVE-2023-37895?

CVE-2023-37895 has a CVSS score of 9.8/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by CVE-2023-37895?

CVE-2023-37895 affects the following packages: org.apache.jackrabbit:jackrabbit-webapp (Maven), org.apache.jackrabbit:jackrabbit-webapp (Maven), org.apache.jackrabbit:jackrabbit-standalone (Maven), org.apache.jackrabbit:jackrabbit-standalone (Maven), org.apache.jackrabbit:jackrabbit-standalone-components (Maven), org.apache.jackrabbit:jackrabbit-standalone-components (Maven). Ecosystems affected: Maven.

How do I fix CVE-2023-37895?

Update org.apache.jackrabbit:jackrabbit-webapp to 2.21.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-37895 is resolved across your whole dependency graph.

How do I detect CVE-2023-37895 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.jackrabbit:jackrabbit-webapp. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate CVE-2023-37895 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against CVE-2023-37895?

O3 pinpoints whether CVE-2023-37895 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is CVE-2023-37895 actively exploited in the wild?

No public exploit code has been indexed for CVE-2023-37895 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2023-37895?

CVE-2023-37895 has an EPSS (Exploit Prediction Scoring System) score of 2.7%, placing it in the 84th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

When was CVE-2023-37895 published, and has it been updated?

CVE-2023-37895 was published on July 25, 2023 and was last updated on April 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

CVE-2023-37895: Remote code execution in Apache Jackrabbit (Cri…

EPSS Exploitation Probability

via FIRST.org ↗

2.7%probability of exploitation in next 30 days

Lower Risk84th percentile-7.35%

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

6 pkgs affected

☕org.apache.jackrabbit:jackrabbit-webapp☕org.apache.jackrabbit:jackrabbit-webapp☕org.apache.jackrabbit:jackrabbit-standalone☕org.apache.jackrabbit:jackrabbit-standalone☕org.apache.jackrabbit:jackrabbit-standalone-components☕org.apache.jackrabbit:jackrabbit-standalone-components

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI.

Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.

In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.

How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.

The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check.

RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.

Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:

<servlet> <servlet-name>RMI</servlet-name> <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class> </servlet>

<servlet-mapping> <servlet-name>RMI</servlet-name> <url-pattern>/rmi</url-pattern> </servlet-mapping>

Find the bootstrap.properties file (in $REPOSITORY_HOME), and set

rmi.enabled=false

and also remove

rmi.host rmi.port rmi.url-pattern

If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.

Affected Packages

6 total 6 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.apache.jackrabbit:jackrabbit-webapp`	≥ 2.21.0&&< 2.21.18	2.21.18
☕Maven	`org.apache.jackrabbit:jackrabbit-webapp`	≥ 1.0.0&&< 2.20.11	2.20.11
☕Maven	`org.apache.jackrabbit:jackrabbit-standalone`	≥ 2.21.0&&< 2.21.18	2.21.18
☕Maven	`org.apache.jackrabbit:jackrabbit-standalone`	≥ 1.0.0&&< 2.20.11	2.20.11
☕Maven	`org.apache.jackrabbit:jackrabbit-standalone-components`	≥ 2.21.0&&< 2.21.18	2.21.18
☕Maven	`org.apache.jackrabbit:jackrabbit-standalone-components`	≥ 1.0.0&&< 2.20.11	2.20.11

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.jackrabbit:jackrabbit-webapp. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update org.apache.jackrabbit:jackrabbit-webapp to 2.21.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-37895 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2023-37895 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2023-37895. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitabl

O3 Security · Impact-Aware SCA

Is CVE-2023-37895 in your dependencies?

O3 detects CVE-2023-37895 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works

CVE-2023-37895