Jetty vulnerabilities
8 vulnerabilities
Known vulnerabilities in Jetty products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Jetty Http Server4 vulnerabilities
- Jetty3 vulnerabilities
- Jetty.Project1 vulnerabilities
CVE-2004-2478caunicenter_web_services_distributed_management+2
EPSS score2.42%
Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.CVE-2004-2381jettyjetty_http_server+1EPSS score1.80%
HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.CVE-2024-22201chainguardsolr+27EPSS score1.43%
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.CVE-2002-1533jettyjetty+1EPSS score2.41%
Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).CVE-2002-1178jettyjetty_http_serverEPSS score9.46%
Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\ (dot-dot backslash) sequences in an HTTP request to the cgi-bin directory.CVE-2006-2758jettyjetty+1EPSS score4.01%
Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL. NOTE: this might be the same issue as CVE-2005-3747.CVE-2006-2759jettyjetty+1EPSS score1.35%
jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations.CVE-2006-6969jettyjetty_http_server+1EPSS score1.61%
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.