CVE-2016-6801
Apache Jackrabbit Authentication Hijacking Vulnerability
Also known as GHSA-9fc7-rhq3-wm7x
Published 10 y ago · modified 4 mo ago · JSON
Summary
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Exploit prediction (EPSS)
2.29% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.jackrabbit:jackrabbit-webdav | >=2.4.0, <2.4.6 >=2.6.0, <2.6.6 >=2.8.0, <2.8.3 >=2.10.0, <2.10.4 >=2.12.0, <2.12.4 >=2.13.0, <2.13.3 | 2.4.6 2.6.6 2.8.3 2.10.4 2.12.4 2.13.3 |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- openwall.com /lists/oss-security/2016/09/14/6 · mailing-list, x_refsource_MLIST, x_transferred
- debian.org /security/2016/dsa-3679 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- issues.apache.org /jira/browse/JCR-4009 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/92966 · vdb-entry, x_refsource_BID, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-6801 · advisory
- github.com /apache/jackrabbit/commit/16f2f02fcaef6202a2bf24c449d4fd10eb98f08d · web
- github.com /apache/jackrabbit/commit/ea75d7c2aeaafecd9ab97736bf81c5616f703244 · web
- github.com /apache/jackrabbit/commit/eae001a54aae9c243ac06b5c8f711b2cb2038700 · web
- github.com /apache/jackrabbit · package
- web.archive.org /web/20210123170657/http://www.securityfocus.com/bid/92966 · web
Sources
- CVE List: CVE-2016-6801
- GitHub Advisory: GHSA-9fc7-rhq3-wm7x
- NVD: CVE-2016-6801
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.