Information Disclosure

jetty-server is vulnerable to Information Disclosure. The vulnerability exists because the cookie parsing of quoted values can exfiltrate values from other cookies because the cookie VALUE that starts with " (double quote) will continue to read the cookie string until it sees a closing quote even if a semicolon is encountered in the library, which allows an attacker to smuggle cookies within other cookies or perform unintended behavior by tampering with the cookie parsing mechanism through the cookie header. For example, the cookie DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d" will result in the cookie name as DISPLAY_LANGUAGE with the value b; JSESSIONID=1337; c=d, instead of parsing of three separate cookies