org.mortbay.jetty:jetty@6.1.0rc2 vulnerabilities

  • latest version

    6.1.26

  • first published

    19 years ago

  • latest version published

    14 years ago

  • licenses detected

    • [test-6.0.0,6.1H.22); [6.1H.4-beta,6.1.17); [7.0.0pre0,)
  • package manager

Direct Vulnerabilities

Known vulnerabilities in the org.mortbay.jetty:jetty package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Path Traversal

org.mortbay.jetty:jetty is a web server and servlet engine.

Affected versions of this package are vulnerable to Path Traversal due to improper handling of encoded directory traversal sequences in the URL. An attacker can read arbitrary files on the server by crafting a URL that includes encoded ../ sequences to navigate the server's directory structure.

Note: This might be the same issue as CVE-2005-3747.

How to fix Path Traversal?

There is no fixed version for org.mortbay.jetty:jetty.

[0,)
  • M
Arbitrary Code Injection

org.mortbay.jetty:jetty is a web server and servlet engine.

Affected versions of this package are vulnerable to Arbitrary Code Injection. An attacker can inject arbitrary HTTP headers and conduct HTTP response splitting attacks.

How to fix Arbitrary Code Injection?

Upgrade org.mortbay.jetty:jetty to version 6.1.6rc0 or higher.

[,6.1.6rc0)
  • M
Directory Traversal

org.mortbay.jetty:jetty is a web server and servlet engine.

Affected versions of this package are vulnerable to Directory Traversal. This issue allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

Note:

In order for a system to be vulnerable, it must either be using the DefaultServlet with support for aliases explicitly enabled or the ResourceHandler class to serve static content.

How to fix Directory Traversal?

Upgrade org.mortbay.jetty:jetty to version 6.1.17 or higher.

[,6.1.17) [7.0.0pre0,)
  • H
Privilege Escalation

org.mortbay.jetty:jetty is a web server and servlet engine.

Affected versions of this package are vulnerable to Privilege Escalation. The system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

How to fix Privilege Escalation?

Upgrade org.mortbay.jetty:jetty to version 7.0.0pre4 or higher.

[6.0.0Beta1,7.0.0pre4)
  • M
Arbitrary Code Injection

org.mortbay.jetty:jetty is a Java HTTP Server and Servlet Container.

Affected versions of this package are vulnerable to Arbitrary Code Injection. Remote attackers may inject arbitrary web script or HTML via unspecified parameters and cookies.

[,6.1.6)
  • H
Session Hijacking

org.mortbay.jetty:jetty is a Java HTTP (Web) server and Java Servlet container.

Affected versions of this package are vulnerable to Session Hijacking. It does not properly handle certain quote sequences in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

How to fix Session Hijacking?

Upgrade org.mortbay.jetty:jetty to version 6.1.6 or higher.

[,6.1.6)
  • M
Arbitrary File Read

org.mortbay.jetty:jetty is a Java HTTP (Web) server and Java Servlet container.

Affected versions of this package are vulnerable to Arbitrary File Read. The software does not properly validate user-supplied input. A remote user can supply a specially crafted request to view files on target system that are located outside of the document directory. A remote user can also view script source code.

How to fix Arbitrary File Read?

Upgrade org.mortbay.jetty:jetty to version 6.1 or higher.

[,6.1)
  • H
Arbitrary Command Execution

org.mortbay.jetty:jetty is an open-source project providing a HTTP server, HTTP client and javax.servlet container.

Affected versions of this package are vulnerable to Arbitrary Command Execution. It writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.

How to fix Arbitrary Command Execution?

A patch was released on version 6.1.22. There is no fix for version 7.0.0.

[6.0.0,6.1.22) [7.0.0,)
  • M
Cryptographic Issues

org.mortbay.jetty:jetty is a web server and servlet engine.

Affected versions of this package are vulnerable to Cryptographic Issues. It computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

How to fix Cryptographic Issues?

There is no fixed version for org.mortbay.jetty:jetty.

[0,)