Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2016-6801

Опубликовано: 21 сент. 2016
Источник: nvd
CVSS3: 8.8
CVSS2: 6.8
EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:jackrabbit:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.4.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.4.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.4.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.6.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.6.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.6.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.8.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.8.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.8.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.10.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.10.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.10.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.10.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.12.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.12.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.12.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.12.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.13.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.13.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:jackrabbit:2.13.2:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 58%
0.0036
Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

ubuntu логотип

CVE-2016-6801

CVSS3: 8.8
ubuntu
больше 9 лет назад

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

debian логотип

CVE-2016-6801

CVSS3: 8.8
debian
больше 9 лет назад

Cross-site request forgery (CSRF) vulnerability in the CSRF content-ty ...

github логотип

GHSA-9fc7-rhq3-wm7x

CVSS3: 8.8
github
больше 3 лет назад

Apache Jackrabbit Authentication Hijacking Vulnerability

EPSS

Процентиль: 58%
0.0036
Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352