PT-2023-8842 · Eclipse+4 · Jetty+4
Mukeran
·
Publicado
2023-09-14
·
Atualizado
2026-05-18
·
CVE-2023-40167
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jetty versions prior to 9.4.52
Jetty versions prior to 10.0.16
Jetty versions prior to 11.0.16
Jetty versions prior to 12.0.1
Description
Jetty is a Java-based web server and servlet engine. It accepts the
+ character proceeding the content-length value in a HTTP/1 header field, which is more permissive than allowed by the RFC. Other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if Jetty is used in combination with a server that does not close the connection after sending such a 400 response.Recommendations
Update to version 9.4.52 or later
Update to version 10.0.16 or later
Update to version 11.0.16 or later
Update to version 12.0.1 or later
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Jetty
Red Os
Suse