Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101827 advisory.

  - Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due     to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions     2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier     versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported     version. (CVE-2025-53689)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due     to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions     2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier     versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported     version. (CVE-2025-53689)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due
    to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions
    2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier
    versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported
    version. (CVE-2025-53689)

ID	Name	Product	Family	Type	Severity
298174	Atlassian Confluence 7.13 < 9.2.11 / 9.3.1 < 10.1.0 (CONFSERVER-101827)	Nessus	CGI abuses	Combined	high
245831	Linux Distros Unpatched Vulnerability : CVE-2025-53689	Nessus	Misc.	Local	high
428382	SCA: security update for org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-spi-commons (GHSA-44c3-38h8-9fh9)	Tenable Cloud Security	SCA Checks	Local	high
428382	SCA: security update for org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-spi-commons (GHSA-44c3-38h8-9fh9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-53689

high

Tenable Plugins

high

high

high

high