| Package | Affected versions | Patched versions |
|---|---|---|
| jackrabbit | ≥ 2.20.0, < 2.20.18≥ 2.22.0, < 2.22.5≥ 2.23.0, < 2.23.6 | 2.20.182.22.52.23.6 |
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free