Aller au contenu
Se connecter
9.3 Critique

CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit

Description

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Jackrabbit 2.23 2.23.0 → 2.23.5 Pas de correctif indiqué
Apache Jackrabbit 2.22 2.22.0 → 2.22.4 Pas de correctif indiqué
Apache Jackrabbit 2.20 2.20.0 → 2.20.17 Pas de correctif indiqué

Autres CVE de Apache Jackrabbit

Les 3 CVE de Apache Jackrabbit →
CVE-2026-92415 — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client 6.9 Moyenne CVE-2025-53689 Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an… Non notée
Suivre cette CVE