Apache Jackrabbit
Monthly
Session fixation and cross-user session reuse in the Apache Jackrabbit WebDAV server lets remote attackers ride on a cached authenticated session, yielding high confidentiality and integrity impact with no credential check performed. The flaw affects Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, and is triggered whenever a request carries a Lock-Token, TransactionId, SubscriptionId, or If-header token value that matches a token bound to a session already held in the server's authenticated session cache. Per the vendor CVSS 4.0 vector the attack is network-reachable, requires no privileges (PR:N) and no user interaction (UI:N), with the practical limiting factor being that the attacker must obtain or guess a token that currently maps to a live cached session; no public exploit code has been identified at time of analysis, and the product does not confirm active exploitation.
Arbitrary file creation or truncation in Apache Jackrabbit's WebDAV/DavEx client (jackrabbit-spi2dav) occurs when a malicious or intercepted remote server supplies externally controlled input that causes the client to instantiate classes from its classpath. Affected versions are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17, but only applications using jackrabbit-spi2dav directly or through jackrabbit-jcr2dav to connect to a remote repository are impacted; Jackrabbit servers are not vulnerable. The vendor CVSS 4.0 base score is 6.9 (medium) with an unauthenticated network vector, and the independent assessment rates CVSS 3.1 as AC:H with integrity-low impact only (C:N/I:L/A:N) because the attacker must control the remote server or intercept the connection; no public exploit code has been identified at time of analysis.
Session fixation and cross-user session reuse in the Apache Jackrabbit WebDAV server lets remote attackers ride on a cached authenticated session, yielding high confidentiality and integrity impact with no credential check performed. The flaw affects Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, and is triggered whenever a request carries a Lock-Token, TransactionId, SubscriptionId, or If-header token value that matches a token bound to a session already held in the server's authenticated session cache. Per the vendor CVSS 4.0 vector the attack is network-reachable, requires no privileges (PR:N) and no user interaction (UI:N), with the practical limiting factor being that the attacker must obtain or guess a token that currently maps to a live cached session; no public exploit code has been identified at time of analysis, and the product does not confirm active exploitation.
Arbitrary file creation or truncation in Apache Jackrabbit's WebDAV/DavEx client (jackrabbit-spi2dav) occurs when a malicious or intercepted remote server supplies externally controlled input that causes the client to instantiate classes from its classpath. Affected versions are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17, but only applications using jackrabbit-spi2dav directly or through jackrabbit-jcr2dav to connect to a remote repository are impacted; Jackrabbit servers are not vulnerable. The vendor CVSS 4.0 base score is 6.9 (medium) with an unauthenticated network vector, and the independent assessment rates CVSS 3.1 as AC:H with integrity-low impact only (C:N/I:L/A:N) because the attacker must control the remote server or intercept the connection; no public exploit code has been identified at time of analysis.