DEBIAN-CVE-2023-41900

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2023-41900
Downstream
DSA-5507-1
Published: 15 Sept 2023, 21:15
Last modified:28 Apr 2026, 20:26

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Sept 2023, 21:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:26
Last Modified
Vulnerability information updated

Description

Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Systems

  • debian•jetty9

    < 9.4.39-3+deb11u2 | < 9.4.50-4+deb12u1 | < 9.4.52-1 | < 9.4.52-1

References (1)