UBUNTU-CVE-2016-6801

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2016-6801

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-6801.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2016-6801

Upstream

CVE-2016-6801

Published

2016-09-21T14:25:00Z

Modified

2025-10-24T04:45:52Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

References

Affected packages

Ubuntu:14.04:LTS / jackrabbit

Package

Name: jackrabbit
Purl: pkg:deb/ubuntu/jackrabbit@2.3.6-1+deb8u2build0.14.04.1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.6-1+deb8u2build0.14.04.1

Affected versions

2.*

2.3.6-1

2.3.6-1+deb8u1build0.14.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.3.6-1+deb8u2build0.14.04.1",
            "binary_name": "libjackrabbit-java"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-6801.json"

Ubuntu:16.04:LTS / jackrabbit