PT-2008-1635 · Mort Bay · Mort Bay Jetty

Published 2008-01-08 · Updated 2022-05-01 · CVE-2007-6672

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mortbay Jetty versions 6.1.5 through 6.1.6

Description The issue allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' characters in the URI. This is achieved by including multiple / (slash) characters in the URI, which enables access to sensitive information.

Recommendations For Mortbay Jetty versions 6.1.5 and 6.1.6, consider restricting access to sensitive files and directories as a temporary workaround until a patch is available. Avoid using multiple / characters in the URI to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-6672

GHSA-4JJW-XRR6-9V3P

Affected Products

Mort Bay Jetty

References · 15

• https://osv.dev/vulnerability/GHSA-4jjw-xrr6-9v3p · Vendor Advisory
• http://secunia.com/advisories/28322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6672 · Security Note
• http://vupen.com/english/advisories/2008/0079 · Note
• http://kb.cert.org/vuls/id/553235 · Note
• http://securityfocus.com/bid/27117 · Note
• http://secunia.com/advisories/28547 · Note
• http://jira.codehaus.org/browse/JETTY-386#action_117699 · Note
• https://web.archive.org/web/20080517012615/http://securityfocus.com/bid/27117 · Note
• https://web.archive.org/web/20080120225728/http://jira.codehaus.org/browse/JETTY/fixforversion/13950 · Note
• https://web.archive.org/web/20080113051254/http://kb.cert.org/vuls/id/553235 · Note
• http://igniterealtime.org/community/message/163752 · Note
• https://web.archive.org/web/20080120225723/http://jira.codehaus.org/browse/JETTY-386 · Note
• http://osvdb.org/39855 · Note
• http://jira.codehaus.org/browse/JETTY/fixforversion/13950 · Note