Detections
Analytics
SCA: security update for org.eclipse.jetty:jetty-http (GHSA-hmr7-m48g-48f6)
medium Tenable Cloud Security Plugin ID 415847
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and
12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This
is more permissive than allowed by the RFC and other servers routinely reject such requests with 400
responses. There is no known exploit scenario, but it is conceivable that request smuggling could result
if jetty is used in combination with a server that does not close the connection after sending such a 400
response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no
workaround as there is no known exploit scenario. (CVE-2023-40167)
See Also
Plugin Details
Severity: Medium
ID: 415847
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2023-40167
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/14/2023
Vulnerability Publication Date: 9/14/2023
Reference Information
CVE: CVE-2023-40167
cwe: CWE-130