PT-2006-3678 · Eclipse · Jetty

Published 2006-06-02 · Updated 2022-05-01 · CVE-2006-2759

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jetty version 6.0.x

Description The issue allows remote attackers to read arbitrary script source code by manipulating the case of the .jsp extension, specifically by using a capital P, and possibly other mixed case manipulations.

Recommendations For jetty version 6.0.x, consider restricting access to .jsp files or implementing case-insensitive handling of file extensions to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-2759

GHSA-MQ4X-8WHH-JX73

Affected Products

Jetty

References · 6

• 🔥 http://securitytracker.com/id?1016168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2759 · Security Note
• https://osv.dev/vulnerability/GHSA-mq4x-8whh-jx73 · Vendor Advisory
• https://github.com/eclipse/jetty.project · Note
• https://eclipse.org/jetty/about.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2759 · Note