Mort Bay Jetty < 6.1.7 Double Slash Information Disclosure

Medium Nessus Network Monitor Plugin ID 4330

Synopsis

The remote web server is affected by an information disclosure vulnerability.

Description

The remote instance of Mort Bay Jetty allows an attacker to view static content in WEB-INF and behind security constraints because of the approach it uses to compact URLs like '/foo///bar'.

Solution

Upgrade to version 6.1.7 or higher.

See Also

http://www.kb.cert.org/vuls/id/553235

http://jira.codehaus.org/browse/JETTY-386#action_117699

Plugin Details

Severity: Medium

ID: 4330

Family: Web Servers

Published: 2008/01/03

Modified: 2016/01/21

Dependencies: 1442

Nessus ID: 29852

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 4.9

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mortbay:jetty

Reference Information

CVE: CVE-2007-6672

BID: 27117