CVE-2015-2080
En bref
- Source
- NVD
- EPSS
- EPSS 75.44 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
- http://seclists.org/fulldisclosure/2015/Mar/12
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
- https://security.netapp.com/advisory/ntap-20190307-0005/
- http://www.securityfocus.com/bid/72768
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
- http://www.securitytracker.com/id/1031800
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-ghgj-3xqr-6jfm — Jetty vulnerable to exposure of sensitive information to unauthenticated remote users
Références européennes
- ENISA EUVD · EUVD-2018-0753
- GCVE · GCVE-0-2015-2080
Avis du CERT-FR
- CERTFR-2018-AVI-184 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.2.3:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.2.4:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.2.5:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.2.6:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.2.7:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.2.8:*:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |