CVE-2016-6801 Apache Jackrabbit Authentication Hijacking Vulnerability
Remote attackers can hijack user authentication to create resources via crafted HTTP POST requests in Apache Jackrabbit WebDAV.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-6801?
CVE-2016-6801 is a high-severity vulnerability in Debian Debian Linux, published on 21 Sep 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Weakness: CWE-352
Which versions are affected by CVE-2016-6801?
12 open source packages ship an affected version, including org.apache.jackrabbit:jackrabbit-webdav. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.10.0 | 2.10.4 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.10.0 | 2.10.4 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.12.0 | 2.12.4 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.12.0 | 2.12.4 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.13.0 | 2.13.3 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.13.0 | 2.13.3 |
6 more packages
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.4.0 | 2.4.6 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.4.0 | 2.4.6 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.6.0 | 2.6.6 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.6.0 | 2.6.6 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.8.0 | 2.8.3 |
org.apache.jackrabbit:jackrabbit-webdav Maven | From 2.8.0 | 2.8.3 |
Products include Apache Jackrabbit, Debian Debian Linux.
How do I fix CVE-2016-6801?
Upgrade org.apache.jackrabbit:jackrabbit-webdav to a fixed version for your release line: 2.10.4, 2.12.4, 2.13.3 or 2.4.6.
Is CVE-2016-6801 being exploited?
There is no known exploitation of CVE-2016-6801 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE
- CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
- CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
- CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
- CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory
Sources
Also known as DEBIAN-CVE-2016-6801, DLA-629-1, DSA-3679-1, GHSA-9fc7-rhq3-wm7x, UBUNTU-CVE-2016-6801.