Mort Bay Jetty < 6.1.7 Double Slash Information Disclosure

medium Nessus Network Monitor Plugin ID 4330

Synopsis

The remote web server is affected by an information disclosure vulnerability.

Description

The remote instance of Mort Bay Jetty allows an attacker to view static content in WEB-INF and behind security constraints because of the approach it uses to compact URLs like '/foo///bar'.

Solution

Upgrade to version 6.1.7 or higher.

Plugin Details

Severity: Medium

ID: 4330

Family: Web Servers

Published: 1/3/2008

Updated: 3/6/2019

Nessus ID: 29852

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mortbay:jetty

Reference Information

CVE: CVE-2007-6672

BID: 27117

Detections

Analytics