PT-2006-3678 · Eclipse · Jetty

Publicado 2006-06-02 · Atualizado 2022-05-01 · CVE-2006-2759

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jetty version 6.0.x

Description The issue allows remote attackers to read arbitrary script source code by manipulating the case of the .jsp extension, specifically by using a capital P, and possibly other mixed case manipulations.

Recommendations For jetty version 6.0.x, consider restricting access to .jsp files or implementing case-insensitive handling of file extensions to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-2759

GHSA-MQ4X-8WHH-JX73

Produtos afetados

Jetty

Referências · 6

• 🔥 http://securitytracker.com/id?1016168 · Exploit
• https://github.com/eclipse/jetty.project · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2759 · Nota de Segurança
• https://eclipse.org/jetty/about.php · Nota
• https://osv.dev/vulnerability/GHSA-mq4x-8whh-jx73 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2759 · Nota