8.8

CVE-2016-6801

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Jackrabbit Version2.4.0
Apache ≫ Jackrabbit Version2.4.1
Apache ≫ Jackrabbit Version2.4.2
Apache ≫ Jackrabbit Version2.4.3
Apache ≫ Jackrabbit Version2.4.4
Apache ≫ Jackrabbit Version2.4.5
Apache ≫ Jackrabbit Version2.6.0
Apache ≫ Jackrabbit Version2.6.1
Apache ≫ Jackrabbit Version2.6.2
Apache ≫ Jackrabbit Version2.6.3
Apache ≫ Jackrabbit Version2.6.4
Apache ≫ Jackrabbit Version2.6.5
Apache ≫ Jackrabbit Version2.8.0
Apache ≫ Jackrabbit Version2.8.1
Apache ≫ Jackrabbit Version2.8.2
Apache ≫ Jackrabbit Version2.10.0
Apache ≫ Jackrabbit Version2.10.1
Apache ≫ Jackrabbit Version2.10.2
Apache ≫ Jackrabbit Version2.10.3
Apache ≫ Jackrabbit Version2.12.0
Apache ≫ Jackrabbit Version2.12.1
Apache ≫ Jackrabbit Version2.12.2
Apache ≫ Jackrabbit Version2.12.3
Apache ≫ Jackrabbit Version2.13.0
Apache ≫ Jackrabbit Version2.13.1
Apache ≫ Jackrabbit Version2.13.2
Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.29% 0.81
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://www.debian.org/security/2016/dsa-3679
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/14/6
Third Party Advisory
http://www.securityfocus.com/bid/92966
Third Party Advisory
VDB Entry
https://issues.apache.org/jira/browse/JCR-4009
Vendor Advisory