DATABASE RESOURCES PRICING ABOUT US

{"id": "DEBIAN_DSA-3679.NASL", "type": "nessus", "bulletinFamily": "scanner", "title": "Debian DSA-3679-1 : jackrabbit - security update", "description": "Lukas Reschke discovered that Apache Jackrabbit, an implementation of the Content Repository for Java Technology API, did not correctly check the Content-Type header on HTTP POST requests, enabling Cross-Site Request Forgery (CSRF) attacks by malicious websites.", "published": "2016-09-28T00:00:00", "modified": "2021-01-11T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 8.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/93747", "reporter": "This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://www.debian.org/security/2016/dsa-3679", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838204", "https://packages.debian.org/source/jessie/jackrabbit", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6801"], "cvelist": ["CVE-2016-6801"], "immutableFields": [], "lastseen": "2021-08-19T12:40:12", "viewCount": 3, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-6801"]}, {"type": "debian", "idList": ["DEBIAN:DLA-629-1:27E06", "DEBIAN:DLA-629-1:A81A1", "DEBIAN:DSA-3679-1:FCA9C"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2016-6801"]}, {"type": "nessus", "idList": ["DEBIAN_DLA-629.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310703679", "OPENVAS:1361412562310807897", "OPENVAS:1361412562310807898", "OPENVAS:703679"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-6801"]}], "rev": 4}, "score": {"value": 6.1, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2016-6801"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3679-1:FCA9C"]}, {"type": "nessus", "idList": ["DEBIAN_DLA-629.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310703679"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-6801"]}]}, "exploitation": null, "vulnersScore": 6.1}, "pluginID": "93747", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3679. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93747);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-6801\");\n script_xref(name:\"DSA\", value:\"3679\");\n\n script_name(english:\"Debian DSA-3679-1 : jackrabbit - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Lukas Reschke discovered that Apache Jackrabbit, an implementation of\nthe Content Repository for Java Technology API, did not correctly\ncheck the Content-Type header on HTTP POST requests, enabling\nCross-Site Request Forgery (CSRF) attacks by malicious websites.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838204\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/jackrabbit\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3679\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the jackrabbit packages.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 2.3.6-1+deb8u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:jackrabbit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"libjackrabbit-java\", reference:\"2.3.6-1+deb8u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "Debian Local Security Checks", "cpe": ["p-cpe:/a:debian:debian_linux:jackrabbit", "cpe:/o:debian:debian_linux:8.0"], "solution": "Upgrade the jackrabbit packages.\n\nFor the stable distribution (jessie), this problem has been fixed in version 2.3.6-1+deb8u2.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {"risk factor": "Medium", "score": "5.9"}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2016-09-27T00:00:00", "vulnerabilityPublicationDate": null, "exploitableWith": [], "_state": {"dependencies": 1645317431}}

{"nessus": [{"lastseen": "2021-08-19T12:40:11", "description": "Lukas Reschke discovered that Apache Jackrabbit, a content repository implementation for Java, was vulnerable to Cross-Site-Request-Forgery in Jackrabbit's webdav module.\n\nThe CSRF content-type check for POST requests did not handle missing Content-Type header fields, nor variations in field values with respect to upper/lower case or optional parameters. This could be exploited to create a resource via CSRF.\n\nFor Debian 7 'Wheezy', these problems have been fixed in version 2.3.6-1+deb7u2.\n\nWe recommend that you upgrade your jackrabbit packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2016-09-19T00:00:00", "type": "nessus", "title": "Debian DLA-629-1 : jackrabbit security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6801"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libjackrabbit-java", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DLA-629.NASL", "href": "https://www.tenable.com/plugins/nessus/93569", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-629-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93569);\n script_version(\"2.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-6801\");\n\n script_name(english:\"Debian DLA-629-1 : jackrabbit security update\");\n script_summary(english:\"Checks dpkg output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Lukas Reschke discovered that Apache Jackrabbit, a content repository\nimplementation for Java, was vulnerable to Cross-Site-Request-Forgery\nin Jackrabbit's webdav module.\n\nThe CSRF content-type check for POST requests did not handle missing\nContent-Type header fields, nor variations in field values with\nrespect to upper/lower case or optional parameters. This could be\nexploited to create a resource via CSRF.\n\nFor Debian 7 'Wheezy', these problems have been fixed in version\n2.3.6-1+deb7u2.\n\nWe recommend that you upgrade your jackrabbit packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2016/09/msg00022.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/jackrabbit\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected libjackrabbit-java package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libjackrabbit-java\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libjackrabbit-java\", reference:\"2.3.6-1+deb7u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2017-07-24T12:54:40", "description": "Lukas Reschke discovered that Apache\nJackrabbit, an implementation of the Content Repository for Java Technology API,\ndid not correctly check the Content-Type header on HTTP POST requests, enabling\nCross-Site Request Forgery (CSRF) attacks by malicious web sites.", "cvss3": {}, "published": "2016-10-05T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3679-1 (jackrabbit - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6801"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:703679", "href": "http://plugins.openvas.org/nasl.php?oid=703679", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3679.nasl 6608 2017-07-07 12:05:05Z cfischer $\n# Auto-generated from advisory DSA 3679-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703679);\n script_version(\"$Revision: 6608 $\");\n script_cve_id(\"CVE-2016-6801\");\n script_name(\"Debian Security Advisory DSA 3679-1 (jackrabbit - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:05 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2016-10-05 15:43:22 +0530 (Wed, 05 Oct 2016)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2016/dsa-3679.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"jackrabbit on Debian Linux\");\n script_tag(name: \"solution\", value: \"For the stable distribution (jessie), this\nproblem has been fixed in version 2.3.6-1+deb8u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.12.4-1.\n\nWe recommend that you upgrade your jackrabbit packages.\");\n script_tag(name: \"summary\", value: \"Lukas Reschke discovered that Apache\nJackrabbit, an implementation of the Content Repository for Java Technology API,\ndid not correctly check the Content-Type header on HTTP POST requests, enabling\nCross-Site Request Forgery (CSRF) attacks by malicious web sites.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libjackrabbit-java\", ver:\"2.3.6-1+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:34:59", "description": "This host is running Apache Jackrabbit\n and is prone to a cross-site request forgery vulnerability.", "cvss3": {}, "published": "2016-10-06T00:00:00", "type": "openvas", "title": "Apache Jackrabbit Cross-Site Request Forgery (CSRF) Vulnerability (Windows)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6801"], "modified": "2018-10-18T00:00:00", "id": "OPENVAS:1361412562310807897", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807897", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_apache_jackrabbit_csrf_vuln_win.nasl 11961 2018-10-18 10:49:40Z asteins $\n#\n# Apache Jackrabbit Cross-Site Request Forgery (CSRF) Vulnerability (Windows)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\nCPE = \"cpe:/a:apache:jackrabbit\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807897\");\n script_cve_id(\"CVE-2016-6801\");\n script_bugtraq_id(92966);\n script_version(\"$Revision: 11961 $\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-18 12:49:40 +0200 (Thu, 18 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-10-06 15:13:16 +0530 (Thu, 06 Oct 2016)\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_name(\"Apache Jackrabbit Cross-Site Request Forgery (CSRF) Vulnerability (Windows)\");\n\n script_tag(name:\"summary\", value:\"This host is running Apache Jackrabbit\n and is prone to a cross-site request forgery vulnerability.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw is due to error in content-type\n check for POST requests which does not handle missing Content-Type header\n fields, nor variations in field values with respect to upper/lower case or\n optional parameters.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to conduct CSRF attacks.\");\n\n script_tag(name:\"affected\", value:\"Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x\n before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4,\n and 2.13.x before 2.13.3 on windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apache Jackrabbit 2.4.6 or\n 2.6.6 or 2.8.3 or 2.10.4 or 2.12.4 or 2.13.3 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"https://issues.apache.org/jira/browse/JCR-4009\");\n script_xref(name:\"URL\", value:\"http://www.openwall.com/lists/oss-security/2016/09/14/6\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_apache_jackrabbit_detect.nasl\", \"os_detection.nasl\");\n script_mandatory_keys(\"apache/jackrabbit/installed\", \"Host/runs_windows\");\n script_xref(name:\"URL\", value:\"http://jackrabbit.apache.org\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\n\nif(!jackPort = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(!version = get_app_version(cpe:CPE, port:jackPort)){\n exit(0);\n}\n\nif((version =~ \"^(2.4.)\") && version_is_less(version: version, test_version: \"2.4.6\"))\n{\n VULN = TRUE;\n fix = \"2.4.6\";\n}\n\nif((version =~ \"^(2.6.)\") && version_is_less(version: version, test_version: \"2.6.6\"))\n{\n VULN = TRUE;\n fix = \"2.6.6\";\n}\n\nif((version =~ \"^(2.8.)\") && version_is_less(version: version, test_version: \"2.8.3\"))\n{\n VULN = TRUE;\n fix = \"2.8.3\";\n}\n\nif((version =~ \"^(2.10.)\") && version_is_less(version: version, test_version: \"2.10.4\"))\n{\n VULN = TRUE;\n fix = \"2.10.4\";\n}\n\nif((version =~ \"^(2.12.)\") && version_is_less(version: version, test_version: \"2.12.4\"))\n{\n VULN = TRUE;\n fix = \"2.12.4\";\n}\n\nif((version =~ \"^(2.13.)\") && version_is_less(version: version, test_version: \"2.13.3\"))\n{\n VULN = TRUE;\n fix = \"2.13.3\";\n}\n\nif(VULN)\n{\n report = report_fixed_ver(installed_version: version, fixed_version: fix);\n security_message(port:jackPort, data: report);\n exit(0);\n}\nexit(0);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:56", "description": "This host is running Apache Jackrabbit\n and is prone to a cross-site request forgery vulnerability.", "cvss3": {}, "published": "2016-10-06T00:00:00", "type": "openvas", "title": "Apache Jackrabbit Cross-Site Request Forgery (CSRF) Vulnerability (Linux)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6801"], "modified": "2018-10-17T00:00:00", "id": "OPENVAS:1361412562310807898", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807898", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_apache_jackrabbit_csrf_vuln_lin.nasl 11938 2018-10-17 10:08:39Z asteins $\n#\n# Apache Jackrabbit Cross-Site Request Forgery (CSRF) Vulnerability (Linux)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\nCPE = \"cpe:/a:apache:jackrabbit\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807898\");\n script_cve_id(\"CVE-2016-6801\");\n script_bugtraq_id(92966);\n script_version(\"$Revision: 11938 $\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-17 12:08:39 +0200 (Wed, 17 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-10-06 16:01:40 +0530 (Thu, 06 Oct 2016)\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n script_name(\"Apache Jackrabbit Cross-Site Request Forgery (CSRF) Vulnerability (Linux)\");\n\n script_tag(name:\"summary\", value:\"This host is running Apache Jackrabbit\n and is prone to a cross-site request forgery vulnerability.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw is due to error in content-type\n check for POST requests which does not handle missing Content-Type header\n fields, nor variations in field values with respect to upper/lower case or\n optional parameters.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to conduct CSRF attacks.\");\n\n script_tag(name:\"affected\", value:\"Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x\n before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4,\n and 2.13.x before 2.13.3 on linux.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apache Jackrabbit 2.4.6 or\n 2.6.6 or 2.8.3 or 2.10.4 or 2.12.4 or 2.13.3 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"https://issues.apache.org/jira/browse/JCR-4009\");\n script_xref(name:\"URL\", value:\"http://www.openwall.com/lists/oss-security/2016/09/14/6\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_apache_jackrabbit_detect.nasl\", \"os_detection.nasl\");\n script_mandatory_keys(\"apache/jackrabbit/installed\", \"Host/runs_unixoide\");\n script_xref(name:\"URL\", value:\"http://jackrabbit.apache.org\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\n\nif(!jackPort = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(!version = get_app_version(cpe:CPE, port:jackPort)){\n exit(0);\n}\n\nif((version =~ \"^(2.4.)\") && version_is_less(version: version, test_version: \"2.4.6\"))\n{\n VULN = TRUE;\n fix = \"2.4.6\";\n}\n\nif((version =~ \"^(2.6.)\") && version_is_less(version: version, test_version: \"2.6.6\"))\n{\n VULN = TRUE;\n fix = \"2.6.6\";\n}\n\nif((version =~ \"^(2.8.)\") && version_is_less(version: version, test_version: \"2.8.3\"))\n{\n VULN = TRUE;\n fix = \"2.8.3\";\n}\n\nif((version =~ \"^(2.10.)\") && version_is_less(version: version, test_version: \"2.10.4\"))\n{\n VULN = TRUE;\n fix = \"2.10.4\";\n}\n\nif((version =~ \"^(2.12.)\") && version_is_less(version: version, test_version: \"2.12.4\"))\n{\n VULN = TRUE;\n fix = \"2.12.4\";\n}\n\nif((version =~ \"^(2.13.)\") && version_is_less(version: version, test_version: \"2.13.3\"))\n{\n VULN = TRUE;\n fix = \"2.13.3\";\n}\n\nif(VULN)\n{\n report = report_fixed_ver(installed_version: version, fixed_version: fix);\n security_message(port:jackPort, data: report);\n exit(0);\n}\nexit(0);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:10", "description": "Lukas Reschke discovered that Apache\nJackrabbit, an implementation of the Content Repository for Java Technology API,\ndid not correctly check the Content-Type header on HTTP POST requests, enabling\nCross-Site Request Forgery (CSRF) attacks by malicious web sites.", "cvss3": {}, "published": "2016-10-05T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3679-1 (jackrabbit - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6801"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310703679", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703679", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3679.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Auto-generated from advisory DSA 3679-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703679\");\n script_version(\"$Revision: 14275 $\");\n script_cve_id(\"CVE-2016-6801\");\n script_name(\"Debian Security Advisory DSA 3679-1 (jackrabbit - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-10-05 15:43:22 +0530 (Wed, 05 Oct 2016)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2016/dsa-3679.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n script_tag(name:\"affected\", value:\"jackrabbit on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (jessie), this\nproblem has been fixed in version 2.3.6-1+deb8u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.12.4-1.\n\nWe recommend that you upgrade your jackrabbit packages.\");\n script_tag(name:\"summary\", value:\"Lukas Reschke discovered that Apache\nJackrabbit, an implementation of the Content Repository for Java Technology API,\ndid not correctly check the Content-Type header on HTTP POST requests, enabling\nCross-Site Request Forgery (CSRF) attacks by malicious web sites.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libjackrabbit-java\", ver:\"2.3.6-1+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2022-02-17T00:20:20", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3679-1 security@debian.org\nhttps://www.debian.org/security/ Florian Weimer\nSeptember 27, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : jackrabbit\nCVE ID : CVE-2016-6801\nDebian Bug : 838204\n\nLukas Reschke discovered that Apache Jackrabbit, an implementation of\nthe Content Repository for Java Technology API, did not correctly\ncheck the Content-Type header on HTTP POST requests, enabling\nCross-Site Request Forgery (CSRF) attacks by malicious web sites.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 2.3.6-1+deb8u2.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.12.4-1.\n\nWe recommend that you upgrade your jackrabbit packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-09-27T10:34:00", "type": "debian", "title": "[SECURITY] [DSA 3679-1] jackrabbit security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-6801"], "modified": "2016-09-27T10:34:00", "id": "DEBIAN:DSA-3679-1:FCA9C", "href": "https://lists.debian.org/debian-security-announce/2016/msg00259.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-23T21:53:58", "description": "Package : jackrabbit\nVersion : 2.3.6-1+deb7u2\nCVE ID : CVE-2016-6801\nDebian Bug : 838204\n\n\nLukas Reschke discovered that Apache Jackrabbit, a content repository\nimplementation for Java, was vulnerable to Cross-Site-Request-Forgery\nin Jackrabbit&#x27;s webdav module.\n\nThe CSRF content-type check for POST requests did not handle missing\nContent-Type header fields, nor variations in field values with\nrespect to upper/lower case or optional parameters. This could be\nexploited to create a resource via CSRF.\n\nFor Debian 7 &quot;Wheezy&quot;, these problems have been fixed in version\n2.3.6-1+deb7u2.\n\nWe recommend that you upgrade your jackrabbit packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-09-18T16:51:43", "type": "debian", "title": "[SECURITY] [DLA 629-1] jackrabbit security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-6801"], "modified": "2016-09-18T16:51:43", "id": "DEBIAN:DLA-629-1:A81A1", "href": "https://lists.debian.org/debian-lts-announce/2016/09/msg00022.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-11-30T03:19:50", "description": "Package : jackrabbit\nVersion : 2.3.6-1+deb7u2\nCVE ID : CVE-2016-6801\nDebian Bug : 838204\n\n\nLukas Reschke discovered that Apache Jackrabbit, a content repository\nimplementation for Java, was vulnerable to Cross-Site-Request-Forgery\nin Jackrabbit&#x27;s webdav module.\n\nThe CSRF content-type check for POST requests did not handle missing\nContent-Type header fields, nor variations in field values with\nrespect to upper/lower case or optional parameters. This could be\nexploited to create a resource via CSRF.\n\nFor Debian 7 &quot;Wheezy&quot;, these problems have been fixed in version\n2.3.6-1+deb7u2.\n\nWe recommend that you upgrade your jackrabbit packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-09-18T16:51:43", "type": "debian", "title": "[SECURITY] [DLA 629-1] jackrabbit security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-6801"], "modified": "2016-09-18T16:51:43", "id": "DEBIAN:DLA-629-1:27E06", "href": "https://lists.debian.org/debian-lts-announce/2016/09/msg00022.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debiancve": [{"lastseen": "2021-12-14T17:49:29", "description": "Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-09-21T14:25:00", "type": "debiancve", "title": "CVE-2016-6801", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-6801"], "modified": "2016-09-21T14:25:00", "id": "DEBIANCVE:CVE-2016-6801", "href": "https://security-tracker.debian.org/tracker/CVE-2016-6801", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:45:45", "description": "Cross-site request forgery (CSRF) vulnerability in the CSRF content-type\ncheck in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x\nbefore 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before\n2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the\nauthentication of unspecified victims for requests that create a resource\nvia an HTTP POST request with a (1) missing or (2) crafted Content-Type\nheader.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-09-21T00:00:00", "type": "ubuntucve", "title": "CVE-2016-6801", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-6801"], "modified": "2016-09-21T00:00:00", "id": "UB:CVE-2016-6801", "href": "https://ubuntu.com/security/CVE-2016-6801", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T15:02:17", "description": "Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-09-21T14:25:00", "type": "cve", "title": "CVE-2016-6801", "cwe": ["CWE-352"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-6801"], "modified": "2016-10-04T17:36:00", "cpe": ["cpe:/a:apache:jackrabbit:2.12.0", "cpe:/a:apache:jackrabbit:2.6.4", "cpe:/a:apache:jackrabbit:2.13.1", "cpe:/a:apache:jackrabbit:2.12.3", "cpe:/o:debian:debian_linux:8.0", "cpe:/a:apache:jackrabbit:2.12.2", "cpe:/a:apache:jackrabbit:2.10.0", "cpe:/a:apache:jackrabbit:2.8.1", "cpe:/a:apache:jackrabbit:2.8.0", "cpe:/a:apache:jackrabbit:2.4.2", "cpe:/a:apache:jackrabbit:2.13.2", "cpe:/a:apache:jackrabbit:2.10.1", "cpe:/a:apache:jackrabbit:2.4.1", "cpe:/a:apache:jackrabbit:2.6.5", "cpe:/a:apache:jackrabbit:2.4.5", "cpe:/a:apache:jackrabbit:2.12.1", "cpe:/a:apache:jackrabbit:2.10.3", "cpe:/a:apache:jackrabbit:2.13.0", "cpe:/a:apache:jackrabbit:2.6.2", "cpe:/a:apache:jackrabbit:2.6.1", "cpe:/a:apache:jackrabbit:2.4.0", "cpe:/a:apache:jackrabbit:2.4.3", "cpe:/a:apache:jackrabbit:2.4.4", "cpe:/a:apache:jackrabbit:2.10.2", "cpe:/a:apache:jackrabbit:2.6.0", "cpe:/a:apache:jackrabbit:2.6.3", "cpe:/a:apache:jackrabbit:2.8.2"], "id": "CVE-2016-6801", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6801", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:apache:jackrabbit:2.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.10.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.12.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.12.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.12.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.13.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.10.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.10.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.13.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:jackrabbit:2.6.5:*:*:*:*:*:*:*"]}]}