org.eclipse.jetty:jetty-client 12.0.38

Direct Vulnerabilities

Known vulnerabilities in the org.eclipse.jetty:jetty-client package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Cleartext Storage of Sensitive Information org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the `SessionAuthentication` process. An attacker can access plaintext passwords of authenticated users by reading persisted session data from storage if they have sufficient privileges. How to fix Cleartext Storage of Sensitive Information? Upgrade `org.eclipse.jetty:jetty-client` to version 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13 or higher.	[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)[12.0.0-alpha0,12.0.39)[12.1.0-alpha0,12.1.13)
H Information Exposure org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the `HttpClient`. An attacker can obtain authentication credentials intended for one path by controlling redirect responses and causing the client to send the `Authorization` header to a different, attacker-controlled path. This is only exploitable if the attacker has an application deployed on the same domain as the target. How to fix Information Exposure? Upgrade `org.eclipse.jetty:jetty-client` to version 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13 or higher.	[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)[12.0.0-alpha0,12.0.39)[12.1.0-alpha0,12.1.13)
H Information Exposure org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the `HttpClient`. An attacker can obtain proxy authentication credentials by crafting a server that responds with a 407 (Proxy Authentication Required) status, causing the client to mistakenly forward the `Proxy-Authentication` header to the server. How to fix Information Exposure? Upgrade `org.eclipse.jetty:jetty-client` to version 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13 or higher.	[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)[12.0.0-alpha0,12.0.39)[12.1.0-alpha0,12.1.13)

Vulnerability

Vulnerable Version

Cleartext Storage of Sensitive Information

org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server.

Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the SessionAuthentication process. An attacker can access plaintext passwords of authenticated users by reading persisted session data from storage if they have sufficient privileges.

How to fix Cleartext Storage of Sensitive Information?

Upgrade org.eclipse.jetty:jetty-client to version 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13 or higher.

[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)[12.0.0-alpha0,12.0.39)[12.1.0-alpha0,12.1.13)

Information Exposure

org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server.

Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain authentication credentials intended for one path by controlling redirect responses and causing the client to send the Authorization header to a different, attacker-controlled path. This is only exploitable if the attacker has an application deployed on the same domain as the target.

How to fix Information Exposure?

Upgrade org.eclipse.jetty:jetty-client to version 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13 or higher.

[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)[12.0.0-alpha0,12.0.39)[12.1.0-alpha0,12.1.13)

Information Exposure

org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server.

Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain proxy authentication credentials by crafting a server that responds with a 407 (Proxy Authentication Required) status, causing the client to mistakenly forward the Proxy-Authentication header to the server.

How to fix Information Exposure?

Upgrade org.eclipse.jetty:jetty-client to version 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13 or higher.

[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)[12.0.0-alpha0,12.0.39)[12.1.0-alpha0,12.1.13)

org.eclipse.jetty:jetty-client@12.0.38

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically