{"id":"GHSA-9fc7-rhq3-wm7x","summary":"Apache Jackrabbit Authentication Hijacking Vulnerability","details":"Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.","aliases":["CVE-2016-6801"],"modified":"2024-02-16T08:06:20.906860Z","published":"2022-05-17T03:48:02Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-07-31T22:54:02Z","nvd_published_at":"2016-09-21T14:25:00Z","cwe_ids":["CWE-352"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6801"},{"type":"WEB","url":"https://github.com/apache/jackrabbit/commit/16f2f02fcaef6202a2bf24c449d4fd10eb98f08d"},{"type":"WEB","url":"https://github.com/apache/jackrabbit/commit/ea75d7c2aeaafecd9ab97736bf81c5616f703244"},{"type":"WEB","url":"https://github.com/apache/jackrabbit/commit/eae001a54aae9c243ac06b5c8f711b2cb2038700"},{"type":"PACKAGE","url":"https://github.com/apache/jackrabbit"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/JCR-4009"},{"type":"WEB","url":"https://web.archive.org/web/20210123170657/http://www.securityfocus.com/bid/92966"},{"type":"WEB","url":"http://www.debian.org/security/2016/dsa-3679"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/09/14/6"}],"affected":[{"package":{"name":"org.apache.jackrabbit:jackrabbit-webdav","ecosystem":"Maven","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webdav"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.6"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9fc7-rhq3-wm7x/GHSA-9fc7-rhq3-wm7x.json"}},{"package":{"name":"org.apache.jackrabbit:jackrabbit-webdav","ecosystem":"Maven","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webdav"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.6"}]}],"versions":["2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9fc7-rhq3-wm7x/GHSA-9fc7-rhq3-wm7x.json"}},{"package":{"name":"org.apache.jackrabbit:jackrabbit-webdav","ecosystem":"Maven","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webdav"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.3"}]}],"versions":["2.8.0","2.8.1","2.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9fc7-rhq3-wm7x/GHSA-9fc7-rhq3-wm7x.json"}},{"package":{"name":"org.apache.jackrabbit:jackrabbit-webdav","ecosystem":"Maven","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webdav"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.4"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9fc7-rhq3-wm7x/GHSA-9fc7-rhq3-wm7x.json"}},{"package":{"name":"org.apache.jackrabbit:jackrabbit-webdav","ecosystem":"Maven","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webdav"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0"},{"fixed":"2.12.4"}]}],"versions":["2.12.0","2.12.1","2.12.2","2.12.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9fc7-rhq3-wm7x/GHSA-9fc7-rhq3-wm7x.json"}},{"package":{"name":"org.apache.jackrabbit:jackrabbit-webdav","ecosystem":"Maven","purl":"pkg:maven/org.apache.jackrabbit/jackrabbit-webdav"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.3"}]}],"versions":["2.13.0","2.13.1","2.13.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9fc7-rhq3-wm7x/GHSA-9fc7-rhq3-wm7x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}