CVE-2016-6801
Apache Jackrabbit Authentication Hijacking Vulnerability
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
CVE-2016-6801- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
CVE-2016-6801- Updated
- 2026-11-02
EUVDEUVD-2022-3363 No score
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
EUVD-2022-3363- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9fc7-rhq3-wm7x
Apache Jackrabbit Authentication Hijacking Vulnerability
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
GHSA-9fc7-rhq3-wm7x- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
CVE-2016-6801- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6801
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
DEBIAN-CVE-2016-6801- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9fc7-rhq3-wm7x
Apache Jackrabbit Authentication Hijacking Vulnerability
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
GHSA-9fc7-rhq3-wm7x- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6801
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
- Record
UBUNTU-CVE-2016-6801- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.4.0 up to 2.4.6 | 2.4.6 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.6.0 up to 2.6.6 | 2.6.6 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.8.0 up to 2.8.3 | 2.8.3 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.10.0 up to 2.10.4 | 2.10.4 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.12.0 up to 2.12.4 | 2.12.4 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.13.0 up to 2.13.3 | 2.13.3 |
jackrabbitDebian:12 |
before 2.12.4-1 | 2.12.4-1 |
jackrabbitDebian:13 |
before 2.12.4-1 | 2.12.4-1 |
jackrabbitDebian:14 |
before 2.12.4-1 | 2.12.4-1 |
jackrabbitDebian:7 |
before 2.3.6-1+deb7u2, plus listed versions 2.3.6-12.3.6-1+deb7u1 |
2.3.6-1+deb7u2 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jackrabbitDebian:8 |
before 2.3.6-1+deb8u2, plus listed versions 2.3.6-12.3.6-1+deb8u1 |
2.3.6-1+deb8u2 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.4.0 up to 2.4.6, plus listed versions 2.4.12.4.22.4.32.4.42.4.5 |
2.4.6 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.6.0 up to 2.6.6, plus listed versions 2.6.12.6.22.6.32.6.42.6.5 |
2.6.6 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.8.0 up to 2.8.3, plus listed versions 2.8.12.8.2 |
2.8.3 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.10.0 up to 2.10.4, plus listed versions 2.10.12.10.22.10.3 |
2.10.4 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.12.0 up to 2.12.4, plus listed versions 2.12.12.12.22.12.3 |
2.12.4 |
org.apache.jackrabbit:jackrabbit-webdavMaven |
2.13.0 up to 2.13.3, plus listed versions 2.13.12.13.2 |
2.13.3 |
jackrabbitUbuntu:14.04:LTS |
before 2.3.6-1+deb8u2build0.14.04.1, plus listed versions 2.3.6-12.3.6-1+deb8u1build0.14.04.1 |
2.3.6-1+deb8u2build0.14.04.1 |
jackrabbitUbuntu:16.04:LTS |
All versions, plus listed versions 2.10.1-12.10.1-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-6801 is a high vulnerability (CVSS 8.8) in Apache Jackrabbit, published September 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in org.apache.jackrabbit:jackrabbit-webdav 2.4.6.
References
openwall.com/lists/oss-security/2016/09/14/6
debian.org/security/2016/dsa-3679
issues.apache.org/jira/browse/JCR-4009
securityfocus.com/bid/92966
nvd.nist.gov/vuln/detail/CVE-2016-6801
web.archive.org/web/20210123170657/http://www.securityfocus.com/bid/92966
Show 11 moreShow less
github.com/apache/jackrabbit/commit/16f2f02fcaef6202a2bf24c449d4fd10eb98f08d
security-tracker.debian.org/tracker/CVE-2016-6801
ubuntu.com/security/CVE-2016-6801
svn.apache.org/r1758791
cve.org/CVERecord?id=CVE-2016-6801