Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source
    of files via multiple '/' (slash) characters in the URI. (CVE-2007-6672)

Greg Wilkins reports :

jetty allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' characters in the URI.

The remote instance of Mort Bay Jetty allows an attacker to view static content in WEB-INF and behind security constraints because of the approach it uses to compact URLs like '/foo///bar'.

ID	Name	Product	Family	Severity
434248	SCA: security update for org.mortbay.jetty:jetty (GHSA-4jjw-xrr6-9v3p)	Tenable Cloud Security	SCA Checks	high
434248	SCA: security update for org.mortbay.jetty:jetty (GHSA-4jjw-xrr6-9v3p)	Tenable Self-Hosted Container Security	SCA Checks	high
37252	FreeBSD : jetty -- multiple vulnerability (0832ee18-cf77-11dc-8c6a-00304881ac9a)	Nessus	FreeBSD Local Security Checks	medium
29852	Mort Bay Jetty URL Multiple Slash Character Information Disclosure	Nessus	CGI abuses	medium
4330	Mort Bay Jetty < 6.1.7 Double Slash Information Disclosure	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2007-6672

high

Tenable Plugins

high

high

medium

medium

medium