CVE-2016-6801
Estado: ModificadaAlta (8.8)—
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.29%
- Percentil entre todas las CVEs puntuadas: 83
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-352
Referencias
- http://www.debian.org/security/2016/dsa-3679
- http://www.openwall.com/lists/oss-security/2016/09/14/6
- http://www.securityfocus.com/bid/92966
- https://issues.apache.org/jira/browse/JCR-4009
- http://www.debian.org/security/2016/dsa-3679
- http://www.openwall.com/lists/oss-security/2016/09/14/6
- http://www.securityfocus.com/bid/92966
- https://issues.apache.org/jira/browse/JCR-4009
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-6801",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-09-21T14:25:21.737",
"references": [
{
"url": "http://www.debian.org/security/2016/dsa-3679",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2016/09/14/6",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/92966",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "https://issues.apache.org/jira/browse/JCR-4009",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2016/dsa-3679",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2016/09/14/6",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/92966",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://issues.apache.org/jira/browse/JCR-4009",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header."
},
{
"lang": "es",
"value": "Vulnerabilidad de CSRF en la verificación de tipo de contenido CSRF en Jackrabbit-Webdav en Apache Jackrabbit 2.4.x en versiones anteriores a 2.4.6, 2.6.x en versiones anteriores a 2.6.6, 2.8.x en versiones anteriores a 2.8.3, 2.10.x en versiones anteriores a 2.10.4, 2.12.x en versiones anteriores a 2.12.4 y 2.13.x en versiones anteriores a 2.13.3 permite a atacantes remotos secuestrar la autenticación de víctimas no especificadas para peticiones que crean un recurso a través de una petición HTTP POST con una (1) pérdida o (2) cabecera Content-Type manipulada."
}
],
"lastModified": "2026-06-17T00:51:47.673",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "765A2672-88CB-40B6-811A-9F4FB503B9A5"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA4CC344-B6B9-48A9-8464-73486964F484"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E361D843-4697-4478-BE2B-4C4E07DC420D"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16B89FBF-D0D6-4126-9DBB-80E8DFE630EA"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B190B1F0-4EAD-48EE-A894-B776537A2ECA"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93B767E2-4E1E-4AF6-BF65-C07769DE88C6"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1C9DD4F-690E-4627-8C20-4931E5039D95"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACED7AF6-383C-4038-9823-BD5F2F054011"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7CFAABB-1E6D-40A4-AE3E-A36A8627CE7A"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F83F02AC-0A32-4949-9EF8-2D3BC3272B08"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21C97A68-5B82-4830-80A9-33052E73A9A6"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.6.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D11B4EE2-94EB-4CF3-9E4C-5F0BF86080E4"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDD80948-AE24-4CA7-97C0-8017E5504A70"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5B8297A-D8B8-4A16-B661-48B5147211A3"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BE8AA33-D15D-4617-AB8E-FFD8D7A1D6A4"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09FE0F9B-6342-4C92-9EC5-561AAAC2034A"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.10.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5624972E-EF0F-4ECC-A5D0-D4B992072ED1"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.10.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F771AB3A-D171-4B8D-BB6C-EB5F6641292D"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.10.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACA85218-EC15-4D79-B7E9-951E2F2FCEB4"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.12.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4FB2EA72-C202-45E1-8D60-2DD25BE81A4E"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.12.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45475992-E9B3-4FA1-AAF9-78C17203141D"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.12.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DC876E9-B7C7-456E-A03B-4555315F9A2A"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.12.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A4E1550-2D19-4BF8-8A88-01240AE1E7ED"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.13.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1B85ECB-6154-4F87-91F1-380CAD5934F7"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1A0F6DE-ECE3-46C0-AD91-AED29A9B166D"
},
{
"criteria": "cpe:2.3:a:apache:jackrabbit:2.13.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA678B1D-A448-4EBA-8B90-2913BA8D30ED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}