GHSA-4jjw-xrr6-9v3p

Source

https://github.com/advisories/GHSA-4jjw-xrr6-9v3p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4jjw-xrr6-9v3p/GHSA-4jjw-xrr6-9v3p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4jjw-xrr6-9v3p

Aliases

CVE-2007-6672

Published

2022-05-01T18:45:22Z

Modified

2024-12-06T05:26:52.443882Z

Summary

Mortbay Jetty Double Slash URI Information Disclosure Vulnerability

Details

Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple / (slash) characters in the URI.

Database specific

{
    "nvd_published_at": "2008-01-08T11:46:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-22T23:30:03Z"
}

References

Affected packages

Maven / org.mortbay.jetty:jetty

Package

Name: org.mortbay.jetty:jetty; View open source insights on deps.dev
Purl: pkg:maven/org.mortbay.jetty/jetty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1.5

Fixed

6.1.7

Affected versions

6.*

6.1.5

6.1.6rc0

6.1.6rc1

6.1.6

Database specific

{
    "last_known_affected_version_range": "<= 6.1.6"
}