Detections
Analytics
Jetty < 6.1.6 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 4307
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running Jetty, a Java web server that can be downloaded off the Internet and is currently bundled with some IBM applications. This version of Jetty is vulnerable to a remote flaw in the way that it handles cookie quotes. An attacker exploiting this flaw would be able to hijack the session of valid users without authentication. Further, this version of Jetty is vulnerable to a flaw in the way that it handles Carriage-Return/Line-Feed characters. An attacker can exploit this flaw to inject malicious HTTP headers into a session. This version of Jetty is also vulnerable to a cross-site scripting (XSS) attack that would allow an attacker to possibly retrieve sensitive data from client browsers.Solution
Upgrade to version 6.1.6 or higher.See Also
Plugin Details
Severity: Medium
ID: 4307
Family: Web Servers
Published: 12/4/2007
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mortbay:jetty