Skip to content
OpenAdvisories
High WID-SEC-2026-3816 2 CVEs

Apache Jackrabbit: Mehrere Schwachstellen

Published Oct 7, 2026 · Updated Oct 7, 2026 · de-DE

Vendor: Apache Product: Jackrabbit Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Jackrabbit ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Dateien zu manipulieren.

Product

Apache Jackrabbit ist ein freies Content-Repository für die Java-Plattform.

Vulnerabilities 2

  • Critical 9.3
    CVE-2026-92414 Public exploit

    Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

    : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issu…

    Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu
  • Medium 6.9
    CVE-2026-92415

    Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

    — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr…

    Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References