Weak Authentication

🗓️ 20 Sep 2023 08:38:31Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 30 Views

Vulnerability in jetty-openid for Weak Authentication

Reporter	Title	Published	Views	Family All 86
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager November 2023 - Multiple CVEs addressed	15 Nov 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	18 Dec 202312:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	22 Oct 202512:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in its dependencies (CVE-2022-45688, CVE-2023-28439, CVE-2023-33201, CVE-2023-41900, CVE-2023-36479, CVE-2023-40167, CVE-2023-36478, )	24 Mar 202514:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Eclipse Jetty	24 Nov 202302:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is vulnerable to various attacks due to Eclipse Jetty (CVE-2023-40167, CVE-2023-41900, CVE-2023-36479, CVE-2023-36478)	15 Dec 202316:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent, Mobile Enterprise Gateway and VPN Module affected by multiple vulnerabilities	6 Feb 202419:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Rational Change	8 Oct 202413:07	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Performance Tester contains vulnerabilities which could affect Eclipse Jetty.	21 Feb 202413:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	8 Mar 202422:36	–	ibm

Vulners

Node

jetty9 jetty9Match9.4.36-1debian

AND

jetty9 jetty9Match9.4.33-1debian

AND

debian debian_linuxMatch11

jetty9 jetty9Match9.4.33-1debian

AND

jetty9 jetty9Match9.4.38-1debian

AND

debian debian_linuxMatch999

eclipse jetty-openidRange9.4.21.v20190926–9.4.51.v20230217java

eclipse jetty-openidRange10.0.0.alpha1–10.0.15java

eclipse jetty-openidRange11.0.0-alpha0–11.0.15java

Source	Link
github	www.github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java
github	www.github.com/eclipse/jetty.project/commit/477c7d18b851e54afb043a61883b274708e7182e
github	www.github.com/eclipse/jetty.project/commit/09e4a61037399242a01323952834667edecd96ee
github	www.github.com/eclipse/jetty.project/commit/194fb28623c4051734d4ec42152245ebcfff0ed6
github	www.github.com/advisories/GHSA-pwh8-58vv-vw48
github	www.github.com/eclipse/jetty.project/pull/9528
github	www.github.com/eclipse/jetty.project/pull/9660
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48
security	www.security.netapp.com/advisory/ntap-20231110-0004/
debian	www.debian.org/security/2023/dsa-5507

07 May 2024 12:11Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.13.5 - 4.3

EPSS0.00141

SSVC