CVE-2016-6801

Published: Sep 21, 2016Modified: May 6, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

Affected (27)

Products: Apache: Jackrabbit · Debian: Debian Linux

1 product

1 product

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Apache Jackrabbit	Version 2.10.0
Apache Jackrabbit	Version 2.10.1
Apache Jackrabbit	Version 2.10.2
Apache Jackrabbit	Version 2.10.3
Apache Jackrabbit	Version 2.12.0
Apache Jackrabbit	Version 2.12.1
Apache Jackrabbit	Version 2.12.2
Apache Jackrabbit	Version 2.12.3
Apache Jackrabbit	Version 2.13.0
Apache Jackrabbit	Version 2.13.1
Apache Jackrabbit	Version 2.13.2
Apache Jackrabbit	Version 2.4.0
Apache Jackrabbit	Version 2.4.1
Apache Jackrabbit	Version 2.4.2
Apache Jackrabbit	Version 2.4.3
Apache Jackrabbit	Version 2.4.4
Apache Jackrabbit	Version 2.4.5
Apache Jackrabbit	Version 2.6.0
Apache Jackrabbit	Version 2.6.1
Apache Jackrabbit	Version 2.6.2
Apache Jackrabbit	Version 2.6.3
Apache Jackrabbit	Version 2.6.4
Apache Jackrabbit	Version 2.6.5
Apache Jackrabbit	Version 2.8.0
Apache Jackrabbit	Version 2.8.1
Apache Jackrabbit	Version 2.8.2