CVE-2016-6801

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

• CWE-352

• http://www.debian.org/security/2016/dsa-3679Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/09/14/6Third Party Advisory
• http://www.securityfocus.com/bid/92966Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/JCR-4009Vendor Advisory
• http://www.debian.org/security/2016/dsa-3679Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/09/14/6Third Party Advisory
• http://www.securityfocus.com/bid/92966Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/JCR-4009Vendor Advisory

Published

Sep 21, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6795In the Convention plugin in Apache Struts 2.3.x before 2.3.3…
• CVE-2016-6796A malicious web application running on Apache Tomcat 9.0.0.M…7.5
• CVE-2016-6797The ResourceLinkFactory implementation in Apache Tomcat 9.0.…7.5
• CVE-2016-6798In the XSS Protection API module before 1.0.12 in Apache Sli…
• CVE-2016-6799Product: Apache Cordova Android 5.2.2 and earlier. The appli…
• CVE-2016-6800The default configuration of the Apache OFBiz framework offe…
• CVE-2016-6802Apache Shiro before 1.3.2 allows attackers to bypass intende…
• CVE-2016-6803An installer defect known as an "unquoted Windows search pat…
• CVE-2016-6804The Apache OpenOffice installer (versions prior to 4.1.3, in…7.8
• CVE-2016-6805Apache Ignite before 1.9 allows man-in-the-middle attackers …
• CVE-2016-6806Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0…
• CVE-2016-6807Custom commands may be executed on Ambari Agent (2.4.x, befo…