PT-2016-7117 · Apache · Apache Jackrabbit

Lukas Reschke · Publicado 2016-09-21 · Atualizado 2022-05-17 · CVE-2016-6801

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jackrabbit versions 2.4.x through 2.4.5 Apache Jackrabbit versions 2.6.x through 2.6.5 Apache Jackrabbit versions 2.8.x through 2.8.2 Apache Jackrabbit versions 2.10.x through 2.10.3 Apache Jackrabbit versions 2.12.x through 2.12.3 Apache Jackrabbit versions 2.13.x through 2.13.2

Description A cross-site request forgery (CSRF) issue exists in the CSRF content-type check in Jackrabbit-Webdav. This allows remote attackers to hijack the authentication of victims for requests that create a resource via an HTTP POST request with a missing or crafted Content-Type header.

Recommendations For Apache Jackrabbit versions 2.4.x through 2.4.5, update to version 2.4.6 or later. For Apache Jackrabbit versions 2.6.x through 2.6.5, update to version 2.6.6 or later. For Apache Jackrabbit versions 2.8.x through 2.8.2, update to version 2.8.3 or later. For Apache Jackrabbit versions 2.10.x through 2.10.3, update to version 2.10.4 or later. For Apache Jackrabbit versions 2.12.x through 2.12.3, update to version 2.12.4 or later. For Apache Jackrabbit versions 2.13.x through 2.13.2, update to version 2.13.3 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-6801

DLA-629-1

DSA-3679-1

GHSA-9FC7-RHQ3-WM7X

Produtos afetados

Apache Jackrabbit

Referências · 21

• https://github.com/apache/jackrabbit · Nota
• https://github.com/apache/jackrabbit/commit/ea75d7c2aeaafecd9ab97736bf81c5616f703244 · Nota
• https://github.com/apache/jackrabbit/commit/16f2f02fcaef6202a2bf24c449d4fd10eb98f08d · Nota
• https://github.com/apache/jackrabbit/commit/eae001a54aae9c243ac06b5c8f711b2cb2038700 · Nota
• https://osv.dev/vulnerability/GHSA-9fc7-rhq3-wm7x · Aviso do Fabricante
• http://svn.apache.org/r1758771 · Nota
• https://web.archive.org/web/20210123170657/http://securityfocus.com/bid/92966 · Nota
• http://securityfocus.com/bid/92966 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6801 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-6801 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6801 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/09/14/6 · Nota
• http://svn.apache.org/r1758764 · Nota
• http://debian.org/security/2016/dsa-3679 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/JCR-4009 · Aviso do Fabricante