Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMD5F8AAD330ACF39440DE13B4EB6D7FA5FFBF91818E99D022E49C689812A35E4A
HistoryApr 29, 2020 - 10:15 a.m.

Security Bulletin: Publicly disclosed vulnerability found by vFinder in IBM eDiscovery Analyzer

2020-04-2910:15:33
www.ibm.com
14

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Summary

Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

Vulnerability Details

CVEID:CVE-2017-7658
**DESCRIPTION:**Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/145522 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2017-7656
**DESCRIPTION:**Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw in the HTTP/1.x Parser. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/145520 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2017-7657
**DESCRIPTION:**Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/145521 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
eDiscovery Analyzer 2.2.2

Remediation/Fixes

**Product **

| VRM|Remediation
—|—|—
IBM eDiscovery Analyzer| 2.2.2|

Use IBM eDiscovery Analyzer 2.2.2 Fix Pack 4 Win and 2.2.2 Fix Pack 4 AIX

Workarounds and Mitigations

None

CPENameOperatorVersion
ediscovery analyzereq2.2.2.4

Related

ibm 23
debian 1
nessus 6
openvas 5
osv 7
fedora 2
f5 2
cve 3
redhatcve 3
github 3
ubuntucve 3
prion 3
debiancve 3
broadcom 1
veracode 3
atlassian 1
symantec 1
hackerone 1
redhat 2
thn 1
oracle 4
ibm
ibm
Security Bulletin: Multiple Vulnerabilities affect IBM Sterling External Authentication Server
2020-07-24 22:19:08
Security Bulletin: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. IBM Rational Performance Tester is affected by this vulnerability.
2020-05-22 13:46:31
Security Bulletin: Publicly Disclosed Vulnerability Found By vFinder (CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12536)
2019-02-12 18:40:01
debian
debian
[SECURITY] [DSA 4278-1] jetty9 security update
2018-08-19 21:21:38
nessus
nessus
Debian DSA-4278-1 : jetty9 - security update
2018-08-20 00:00:00
Fedora 28 : jetty (2018-48b73ed393)
2019-01-03 00:00:00
F5 Networks BIG-IP : Eclipse Jetty vulnerabilities (K10002140)
2022-04-05 00:00:00
openvas
openvas
Debian Security Advisory DSA 4278-1 (jetty9 - security update)
2018-08-19 00:00:00
Fedora Update for jetty FEDORA-2018-48b73ed393
2018-07-15 00:00:00
Fedora Update for jetty FEDORA-2018-93a507fd0f
2018-07-15 00:00:00
osv
osv
jetty9 - security update
2018-08-19 00:00:00
CVE-2017-7657
2018-06-26 16:29:00
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
2018-10-19 16:15:34
fedora
fedora
[SECURITY] Fedora 28 Update: jetty-9.4.11-2.v20180605.fc28
2018-07-12 14:21:30
[SECURITY] Fedora 27 Update: jetty-9.4.11-2.v20180605.fc27
2018-07-12 13:47:39
f5
f5
K10002140 : Eclipse Jetty vulnerabilities CVE-2017-7657 and CVE-2017-7658
2022-04-05 00:00:00
K21054458 : Eclipse Jetty vulnerability CVE-2017-7656
2022-04-19 00:00:00
cve
cve
CVE-2017-7657
2018-06-26 16:29:00
CVE-2017-7658
2018-06-26 17:29:00
CVE-2017-7656
2018-06-26 15:29:00
redhatcve
redhatcve
CVE-2017-7658
2018-06-27 08:49:18
CVE-2017-7657
2019-10-08 10:49:34
CVE-2017-7656
2018-06-27 09:18:40
github
github
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
2018-10-19 16:16:38
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
2018-10-19 16:15:34
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
2018-10-19 16:16:27
ubuntucve
ubuntucve
CVE-2017-7658
2018-06-26 00:00:00
CVE-2017-7657
2018-06-26 00:00:00
CVE-2017-7656
2018-06-26 00:00:00
prion
prion
Integer overflow
2018-06-26 16:29:00
Authorization
2018-06-26 17:29:00
Default configuration
2018-06-26 15:29:00
debiancve
debiancve
CVE-2017-7657
2018-06-26 16:29:00
CVE-2017-7658
2018-06-26 17:29:00
CVE-2017-7656
2018-06-26 15:29:00
broadcom
broadcom
A remote attacker can supply specially crafted transfer-encoding chunks to Eclipse Jetty that may bypass the authorization checks of an intermediary caching proxy.
2023-08-29 00:00:00
veracode
veracode
Request Smuggling
2018-07-19 08:32:02
HTTP Request Smuggling
2018-06-26 14:52:07
HTTP Request Smuggling
2018-06-26 12:30:42
atlassian
atlassian
Cache Poisoning org.eclipse.jetty:jetty-server in Jira Software Data Center and Server
2023-09-26 16:17:11
symantec
symantec
Eclipse Jetty CVE-2017-7656 Security Vulnerability
2018-06-07 00:00:00
hackerone
hackerone
Internet Bug Bounty: Multiple HTTP Smuggling reports
2019-07-17 22:47:10
redhat
redhat
(RHSA-2019:0910) Important: Red Hat Fuse 7.3 security update
2019-04-30 15:17:04
(RHSA-2020:3779) Important: Red Hat Data Grid 7.3.7 security update
2020-09-17 13:03:47
thn
thn
Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems
2021-08-23 13:27:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - July 2021
2021-07-20 00:00:00
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON
Related for D5F8AAD330ACF39440DE13B4EB6D7FA5FFBF91818E99D022E49C689812A35E4A
ibm23debian1nessus6openvas5osv7fedora2f52cve3redhatcve3github3ubuntucve3prion3debiancve3broadcom1veracode3atlassian1symantec1hackerone1redhat2thn1oracle4