Description
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackrabbit | 2.12.4-1 | — |
| Debian 13 | jackrabbit | 2.12.4-1 | — |
| Debian 12 | jackrabbit | 2.12.4-1 | — |
| Debian 8 | jackrabbit | 2.3.6-1+deb8u2 | DSA-3679-1 |
| Debian 7 | jackrabbit | 2.3.6-1+deb7u2 | DLA-629-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jackrabbit | No fix yet | — |
| Ubuntu 14.04 LTS | jackrabbit | 2.3.6-1+deb8u2build0.14.04.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.jackrabbit:jackrabbit-webdav | >= 2.4.0, < 2.4.6 | 2.4.6 | GHSA-9fc7-rhq3-wm7x |
| Maven | org.apache.jackrabbit:jackrabbit-webdav | >= 2.6.0, < 2.6.6 | 2.6.6 | GHSA-9fc7-rhq3-wm7x |
| Maven | org.apache.jackrabbit:jackrabbit-webdav | >= 2.8.0, < 2.8.3 | 2.8.3 | GHSA-9fc7-rhq3-wm7x |
| Maven | org.apache.jackrabbit:jackrabbit-webdav | >= 2.10.0, < 2.10.4 | 2.10.4 | GHSA-9fc7-rhq3-wm7x |
| Maven | org.apache.jackrabbit:jackrabbit-webdav | >= 2.12.0, < 2.12.4 | 2.12.4 | GHSA-9fc7-rhq3-wm7x |
| Maven | org.apache.jackrabbit:jackrabbit-webdav | >= 2.13.0, < 2.13.3 | 2.13.3 | GHSA-9fc7-rhq3-wm7x |
Advisories 2
- DLA-629-1 jackrabbit - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3679-1 jackrabbit - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20160914 CVE-2016-6801: CSRF in Jackrabbit-Webdav using empty content-type mailing-list
- DSA-3679 vendor-advisory
- https://issues.apache.org/jira/browse/JCR-4009
- 92966 vdb-entry