CyberRota Analysis
AI-GeneratedThe Apache Jackrabbit WebDAV server is vulnerable to session fixation and session reuse attacks, allowing an attacker to exploit cached authenticated sessions without proper credential verification. This critical vulnerability affects versions 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, potentially compromising user sessions. Organizations using these affected versions should prioritize upgrading to 2.23.6, 2.22.5, or 2.20.18 to mitigate the risk.
Original NVD Description
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)