PT-2008-1635 · Mort Bay · Mort Bay Jetty

Publicado 2008-01-08 · Atualizado 2022-05-01 · CVE-2007-6672

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mortbay Jetty versions 6.1.5 through 6.1.6

Description The issue allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' characters in the URI. This is achieved by including multiple / (slash) characters in the URI, which enables access to sensitive information.

Recommendations For Mortbay Jetty versions 6.1.5 and 6.1.6, consider restricting access to sensitive files and directories as a temporary workaround until a patch is available. Avoid using multiple / characters in the URI to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-6672

GHSA-4JJW-XRR6-9V3P

Produtos afetados

Mort Bay Jetty

Referências · 15

• http://vupen.com/english/advisories/2008/0079 · Nota
• http://kb.cert.org/vuls/id/553235 · Nota
• http://securityfocus.com/bid/27117 · Nota
• http://secunia.com/advisories/28547 · Nota
• https://osv.dev/vulnerability/GHSA-4jjw-xrr6-9v3p · Aviso do Fabricante
• http://secunia.com/advisories/28322 · Aviso do Fabricante
• http://jira.codehaus.org/browse/JETTY-386#action_117699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6672 · Nota de Segurança
• https://web.archive.org/web/20080517012615/http://securityfocus.com/bid/27117 · Nota
• https://web.archive.org/web/20080120225728/http://jira.codehaus.org/browse/JETTY/fixforversion/13950 · Nota
• https://web.archive.org/web/20080113051254/http://kb.cert.org/vuls/id/553235 · Nota
• http://igniterealtime.org/community/message/163752 · Nota
• https://web.archive.org/web/20080120225723/http://jira.codehaus.org/browse/JETTY-386 · Nota
• http://osvdb.org/39855 · Nota
• http://jira.codehaus.org/browse/JETTY/fixforversion/13950 · Nota