High severity · published Sep 21, 2016
CVE-2016-6801
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before…
8.8
CVSS
2.3%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
8.0 · source: NVD
JA
Jackrabbit · Apache
2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6801
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6801
Third Party Advisory
http://www.debian.org/security/2016/dsa-3679
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/14/6
Third Party Advisory
http://www.securityfocus.com/bid/92966
Vendor Advisory
https://issues.apache.org/jira/browse/JCR-4009
More from Jackrabbit
9.8
CVE-2023-37895
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable…
9.1
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
8.8
CVE-2025-53689
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges
6.5
CVE-2025-58782
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons
5.3
CVE-2026-92415
Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies