Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies

🗓️ 18 Apr 2023 22:19:57Reported by GitHub Advisory DatabaseType

Jetty cookie parsing vulnerability allows smuggling of cookie

Reporter	Title	Published	Views	Family All 151
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2023-26049)	16 Nov 202320:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 20 (4.2.0.20)	11 Nov 202411:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in eclipse jetty affect IBM Business Automation Workflow	3 Jun 202413:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security fixes available for The IBM® Engineering System Design Rhapsody products on IBM Jazz Technology	7 Jun 202406:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	27 Mar 202608:06	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	11 Mar 202620:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Eclipse Jetty	29 Nov 202314:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	20 Mar 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jetty-http affects IBM Cloud Pak for Data System 1.0(CPDS 1.0) [CVE-2023-26049]	31 Jul 202311:08	–	ibm

Vulners

Node

org.eclipse.jetty jetty-serverRange<9.4.51.v20230217maven

org.eclipse.jetty jetty-serverRange12.0.0alpha0–12.0.0.beta0maven

org.eclipse.jetty jetty-serverRange11.0.0–11.0.14maven

org.eclipse.jetty jetty-serverRange10.0.0–10.0.14maven

Source	Link
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-26049
github	www.github.com/eclipse/jetty.project/pull/9339
github	www.github.com/eclipse/jetty.project/pull/9352
rfc-editor	www.rfc-editor.org/rfc/rfc2965
rfc-editor	www.rfc-editor.org/rfc/rfc6265
security	www.security.netapp.com/advisory/ntap-20230526-0001/
github	www.github.com/eclipse/jetty.project/releases/tag/jetty-9.4.51.v20230217
debian	www.debian.org/security/2023/dsa-5507
lists	www.lists.debian.org/debian-lts-announce/2023/09/msg00039.html

06 Nov 2023 05:01Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.12.4 - 5.3

EPSS0.00403

CWE-200