CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
91.1%
Mortbay Jetty before 6.1.6rc1 does not properly handle “certain quote sequences” in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Vendor | Product | Version | CPE |
---|---|---|---|
mortbay_jetty | jetty | 1.0 | cpe:2.3:a:mortbay_jetty:jetty:1.0:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 2.4 | cpe:2.3:a:mortbay_jetty:jetty:2.4:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 3.0 | cpe:2.3:a:mortbay_jetty:jetty:3.0:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 3.1 | cpe:2.3:a:mortbay_jetty:jetty:3.1:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 4.0 | cpe:2.3:a:mortbay_jetty:jetty:4.0:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 4.1 | cpe:2.3:a:mortbay_jetty:jetty:4.1:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 4.2 | cpe:2.3:a:mortbay_jetty:jetty:4.2:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 5 | cpe:2.3:a:mortbay_jetty:jetty:5:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 5.1 | cpe:2.3:a:mortbay_jetty:jetty:5.1:*:*:*:*:*:*:* |
mortbay_jetty | jetty | 6 | cpe:2.3:a:mortbay_jetty:jetty:6:*:*:*:*:*:*:* |
osvdb.org/42496
secunia.com/advisories/27925
secunia.com/advisories/30941
secunia.com/advisories/35143
svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
www.kb.cert.org/vuls/id/438616
www.securityfocus.com/bid/26695
www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html
www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html