Information Disclosure

🗓️ 24 Apr 2023 04:51:24Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 87 Views

jetty-server vulnerable to Information Disclosure due to faulty cookie parsin

Reporter	Title	Published	Views	Family All 152
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2023-26049)	16 Nov 202320:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 20 (4.2.0.20)	11 Nov 202411:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in eclipse jetty affect IBM Business Automation Workflow	3 Jun 202413:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security fixes available for The IBM® Engineering System Design Rhapsody products on IBM Jazz Technology	7 Jun 202406:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	27 Mar 202608:06	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	11 Mar 202620:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Eclipse Jetty	29 Nov 202314:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	20 Mar 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jetty-http affects IBM Cloud Pak for Data System 1.0(CPDS 1.0) [CVE-2023-26049]	31 Jul 202311:08	–	ibm

Vulners

Node

jetty9 jetty9Match9.4.33-1debian

AND

jetty9 jetty9Match9.4.36-1debian

AND

debian debian_linuxMatch11

jetty9 jetty9Match9.4.16-0+deb10u1debian

AND

jetty9 jetty9Match9.4.15-1debian

AND

debian debian_linuxMatch10

jetty9 jetty9Match9.4.33-1debian

AND

jetty9 jetty9Match9.4.38-1debian

AND

debian debian_linuxMatch999

eclipse jetty-serverRange12.0.0.alpha0–12.0.0.alpha3java

eclipse jetty-serverRange11.0.0-alpha0–11.0.13java

eclipse jetty-serverRange10.0.0-alpha0–10.0.13java

eclipse jetty-serverRange7.0.0.M0–9.4.50.v20221201java

eclipse jetty-httpRange12.0.0.alpha0–12.0.0.alpha3java

eclipse jetty-httpRange11.0.0-alpha0–11.0.13java

eclipse jetty-httpRange10.0.0-alpha0–10.0.13java

eclipse jetty-httpRange7.0.0.M0–9.4.50.v20221201java

Source	Link
github	www.github.com/eclipse/jetty.project/commit/7b8c2c1bf081c7f408e5da3371c8c3c9802f09fd
github	www.github.com/eclipse/jetty.project/pull/9352
github	www.github.com/eclipse/jetty.project/pull/9339
github	www.github.com/eclipse/jetty.project/commit/1be1401bafb4c46fae3c234c8e93743a661dcf21
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c
lists	www.lists.debian.org/debian-lts-announce/2023/09/msg00039.html
security	www.security.netapp.com/advisory/ntap-20230526-0001/
debian	www.debian.org/security/2023/dsa-5507
rfc-editor	www.rfc-editor.org/rfc/rfc2965
rfc-editor	www.rfc-editor.org/rfc/rfc6265

01 Feb 2024 19:07Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.12.4 - 5.3

EPSS0.00403