HTTP Request Smuggling

2023-09-2009:06:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jetty

http request smuggling

vulnerability

exploitation

attack

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

26.0%

JSON

Jetty is vulnerable to HTTP Request Smuggling. The vulnerability is due to accepting + character proceeding the content-length in the request. This vulnerability can be exploited by the attacker to possibly conduct request smuggling attacks.

CPENameOperatorVersion
core :: httple10.0.15
core :: httple12.0.0
core :: httple11.0.15
core :: httple9.4.51.v20230217
jetty9:bullseyeeq9.4.36-1
jetty9:bullseyeeq9.4.33-1
jetty9:bustereq9.4.15-1
jetty9:bustereq9.4.16-0+deb10u1
jetty9:sideq9.4.33-1
jetty9:sideq9.4.38-1

Name	Operator	Version
core :: http	le	10.0.15
core :: http	le	12.0.0
core :: http	le	11.0.15
core :: http	le	9.4.51.v20230217
jetty9:bullseye	eq	9.4.36-1
jetty9:bullseye	eq	9.4.33-1
jetty9:buster	eq	9.4.15-1
jetty9:buster	eq	9.4.16-0+deb10u1
jetty9:sid	eq	9.4.33-1
jetty9:sid	eq	9.4.38-1