CVE-2015-2080: eclipse jetty
CVSS: 7.5v3.0HighModified
AliasesCGA-77xc-g5xp-m2ccCGA-7v44-hrr9-x87xCGA-8ppc-r6c8-c5wgCGA-9rhr-9c9q-689xCGA-hf25-g7vm-xgrfCGA-mq69-jj76-2vqmGHSA-ghgj-3xqr-6jfmCGA-r4hx-5gq2-h28gCGA-x2qr-fvjq-pj42
Published 07-10-2016Last modified 06-08-2024
Vulnerability summary
CVE-2015-2080 is a high (CVSS 7.5) vulnerability in eclipse jetty. EPSS estimates a 75.44% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 5 public exploits are recorded.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
75.44%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits5github, reference, exploit-database
Timeline
- 07-10-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
75.44%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 75.44% on 18-09-2026
18-09-202618-10-2026
EPSS score75.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundJetty.Project
Maturity: poc
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Eclipse1 product
- jettyEOL9.2.3 | 9.2.4 | 9.2.5 | 9.2.6 | 9.2.7 | 9.2.8 | 9.3.0:m0 | 9.3.0:m1
Fedoraproject1 product
- fedoraEOL22
Org.eclipse.jetty1 product
- jetty-server< 9.2.9.v20150224
4 vendors · 6 products
References
14 links- seclists.org/fulldisclosure/2015/Mar/12Mailing ListX Refsource FULLDISCExploitThird Party AdvisoryWEB
- dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.htmlMailing ListX Refsource MLISTVendor AdvisoryWEB
- dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.htmlMailing ListX Refsource MLISTVendor AdvisoryWEB
- security.netapp.com/advisory/ntap-20190307-0005/X Refsource CONFIRM
- packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.htmlX Refsource MISCExploitThird Party AdvisoryWEB
Show all 14 references
- lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
