Description

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

Remediation

References

http://www.openwall.com/lists/oss-security/2016/09/14/6

https://issues.apache.org/jira/browse/JCR-4009

http://www.debian.org/security/2016/dsa-3679

http://www.securityfocus.com/bid/92966

Related Vulnerabilities

CVE-2020-7642 Vulnerability in maven package org.webjars.bowergithub.afarkas:lazysizes

CVE-2017-7686 Vulnerability in maven package org.apache.ignite:ignite-core

CVE-2020-13942 Vulnerability in maven package org.apache.unomi:unomi-common

CVE-2022-24822 Vulnerability in npm package @podium/proxy

CVE-2019-19771 Vulnerability in npm package degbu

Severity

Critical

Classification

CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Vendor Advisory VDB Entry