CVE-2016-6801 json
Apache Jackrabbit Authentication Hijacking Vulnerability
published 2016-09-21 10 y ago modified 2026-06-17 4 mo ago also GHSA-9fc7-rhq3-wm7x , EUVD-2022-3363
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Patch / fix
- maven org.apache.jackrabbit:jackrabbit-webdav 2.4.6, 2.6.6, 2.8.3, 2.10.4, 2.12.4, 2.13.3
- jackrabbit Debian 14, Debian 13, Debian 12 2.12.4-1
debian advisories DEBIAN-CVE-2016-6801
- jackrabbit Ubuntu 14.04 LTS 2.3.6-1+deb8u2build0.14.04.1
ubuntu advisories UBUNTU-CVE-2016-6801
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Exploit prediction
2.29% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.jackrabbit:jackrabbit-webdav | >=2.4.0, <2.4.6 >=2.6.0, <2.6.6 >=2.8.0, <2.8.3 >=2.10.0, <2.10.4 >=2.12.0, <2.12.4 >=2.13.0, <2.13.3 |
2.4.6 2.6.6 2.8.3 2.10.4 2.12.4 2.13.3 |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/apache/jackrabbit/commit/16f2f02fcaef6202a2bf24c449d4fd10eb98f08d
web
-
github.com
/apache/jackrabbit/commit/ea75d7c2aeaafecd9ab97736bf81c5616f703244
web
-
github.com
/apache/jackrabbit/commit/eae001a54aae9c243ac06b5c8f711b2cb2038700
web
-
debian.org
/security/2016/dsa-3679
vendor-advisory, web, third-party-advisory
-
issues.apache.org
/jira/browse/JCR-4009
web, vendor-advisory
-
openwall.com
/lists/oss-security/2016/09/14/6
mailing-list, web, third-party-advisory
-
securityfocus.com
/bid/92966
vdb-entry, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2016-6801
advisory
-
github.com
/apache/jackrabbit
package
-
web.archive.org
/web/20210123170657/http://www.securityfocus.com/bid/92966
web
Sources
- CVE List CVE-2016-6801
- GitHub Advisory GHSA-9fc7-rhq3-wm7x
- NVD CVE-2016-6801
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.