CVE-2016-6801
HighSummary
CVE-2016-6801 involves a content-type check vulnerability in Jackrabbit-Webdav, allowing remote attackers to hijack the authentication of victims for resource creation via an HTTP POST request with a missing or crafted Content-Type header.
Risk Assessment
CSRF attacks can lead to unauthorized access to resources and potential data loss, posing a serious security threat to the organization.
Recommendation
It is recommended to update Apache Jackrabbit to versions 2.4.6, 2.6.6, 2.8.3, 2.10.4, 2.12.4, or 2.13.3 to mitigate this vulnerability.
Other vulnerabilities in Apache Jackrabbit
See all- CVE-2026-92414Critical
Session Fixation / Session Reuse vulnerability in Apache Jackrabbit. The WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match without credential check. Affects versions from 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17.
- CVE-2026-92415Medium
A vulnerability of type "Use of Externally-Controlled Input to Select Classes or Code" in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH).
- CVE-2025-58782Medium
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons (versions 1.0.0 through 2.22.1). Deployments that accept JNDI URIs for JCR lookup from untrusted users allow them to inject malicious JNDI references, potentially leading to arbitrary code execution.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS