CVE

Id
93621  
CVE No.
CVE-2016-6801  
Status
Candidate  
Description
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.  
Phase
Assigned (20160812)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794144 93621 CVE-2016-6801 MLIST:[oss-security] 20160914 CVE-2016-6801: CSRF in Jackrabbit-Webdav using empty content-type  View
794145 93621 CVE-2016-6801 URL:http://www.openwall.com/lists/oss-security/2016/09/14/6  View
794146 93621 CVE-2016-6801 CONFIRM:https://issues.apache.org/jira/browse/JCR-4009  View
794147 93621 CVE-2016-6801 DEBIAN:DSA-3679  View
794148 93621 CVE-2016-6801 URL:http://www.debian.org/security/2016/dsa-3679  View
794149 93621 CVE-2016-6801 BID:92966  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
3766 JVNDB-2016-004539 Siemens SIPROTEC 4 および SIPROTEC Compact デバイス用 EN100 Ethernet モジュールにおける認証を回避される脆弱性 Siemens SIPROTEC 4 および SIPROTEC Compact デバイス用 EN100 Ethernet モジュールには、認証を回避され、管理アクセス権を取得される脆弱性が存在します。 CVE-2016-7114 93621 9 8.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004539.html  View