Jetty@9.3.0 Security Vulnerabilities and Issues — Jetty@9.3.0 CVE List

Lucene search

EclipseJetty9.3.0

5 matches found

CVE•added 2019/04/22 8:29 p.m.•299 views

CVE-2019-10247

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches t...

5.3CVSS6AI score0.0711EPSS

CVE•added 2019/04/22 8:29 p.m.•180 views

CVE-2019-10241

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

6.1CVSS6.1AI score0.10588EPSS

CVE•added 2016/10/07 2:59 p.m.•148 views

CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

7.5CVSS7.2AI score0.92414EPSS

CVE•added 2019/03/27 8:29 p.m.•102 views

CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required ...

7.5CVSS7.3AI score0.05311EPSS

CVE•added 2017/04/13 2:59 p.m.•93 views

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

9.8CVSS9.1AI score0.00643EPSS