Use of Non-Canonical URL Paths for Authorization Decisions

Overview org.eclipse.jetty:jetty-util is a Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions due to incorrect handling of ; path-parameter...

Cross-site Scripting (XSS)

jetty-util is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the directory listing does not encode characters in UTF-8, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through unicode characters...

Information Disclosure

jetty-util is vulnerable to information disclosure. Eclipse Jetty on Windows reveals the resource base path of files in the directory listings page...

Information Disclosure

jetty-util and jetty-servlet is vulnerable to information disclosures. When handling a query with bad characters that doesn't match the url-pattern, the application throws an InvalidPathException that shows the full path to the base resource directory of the web application...