GitHub Advisoryadvisory · Maven

GHSA-9fc7-rhq3-wm7x Apache Jackrabbit Authentication Hijacking Vulnerability

HIGH Published 2022-05-17 Modified 2023-11-07 Official page ↗
Aliases
CVE-2016-6801
Ecosystem
Maven
Packages
org.apache.jackrabbit:jackrabbit-webdav
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-07-31

Affected packages

• Maven org.apache.jackrabbit:jackrabbit-webdav: >= 2.4.0, < 2.4.6 → fixed in 2.4.6 • Maven org.apache.jackrabbit:jackrabbit-webdav: >= 2.6.0, < 2.6.6 → fixed in 2.6.6 • Maven org.apache.jackrabbit:jackrabbit-webdav: >= 2.8.0, < 2.8.3 → fixed in 2.8.3 • Maven org.apache.jackrabbit:jackrabbit-webdav: >= 2.10.0, < 2.10.4 → fixed in 2.10.4 • Maven org.apache.jackrabbit:jackrabbit-webdav: >= 2.12.0, < 2.12.4 → fixed in 2.12.4 • Maven org.apache.jackrabbit:jackrabbit-webdav: >= 2.13.0, < 2.13.3 → fixed in 2.13.3

Description

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

Related

Alias · CVE (1)

  • CVE-2016-6801 Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References