The remote host is running Jetty, a Java web server that can be downloaded off the Internet and is currently bundled with some IBM applications.  This version of Jetty is vulnerable to a remote flaw in the way that it handles cookie quotes.  An attacker exploiting this flaw would be able to hijack the session of valid users without authentication.  Further, this version of Jetty is vulnerable to a flaw in the way that it handles Carriage-Return/Line-Feed characters.  An attacker can exploit this flaw to inject malicious HTTP headers into a session.  This version of Jetty is also vulnerable to a cross-site scripting (XSS) attack that would allow an attacker to possibly retrieve sensitive data from client browsers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie
    parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
    (CVE-2007-5614)

- Bug #417411 - CVE-2007-5615: jetty CRLF injection

  - Bug #417391 - CVE-2007-5613: jetty cross site scripting

  - Bug #417401 - CVE-2007-5614: jetty session hijacking     issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jul 4 2008 Jeff Johnston <jjohnstn at redhat.com>     5.1.14-1jpp.1

    - Security patch

    - Resolves #417401, #417411, #417391

    - Upgrade to 5.1.14 source tarball for Fedora

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.

Mortbay Jetty before 6.1.6rc1 does not properly handle 'certain quote sequences' in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

ID	名稱	產品	系列	已發布	已更新	嚴重性
4307	Jetty < 6.1.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2007/12/4	2019/3/6	medium
414710	SCA: security update for org.mortbay.jetty:jetty (GHSA-fvh3-4v5r-cvvc)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	high
414710	SCA: security update for org.mortbay.jetty:jetty (GHSA-fvh3-4v5r-cvvc)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	high
33417	Fedora 9 : jetty-5.1.14-1jpp.2.fc9 (2008-6141)	Nessus	Fedora Local Security Checks	2008/7/8	2021/1/11	high
33418	Fedora 8 : jetty-5.1.14-1jpp.1.fc8 (2008-6164)	Nessus	Fedora Local Security Checks	2008/7/8	2021/1/11	high
29288	FreeBSD : jetty -- multiple vulnerabilities (6ae7cef2-a6ae-11dc-95e6-000c29c5647f)	Nessus	FreeBSD Local Security Checks	2007/12/11	2021/1/6	high

偵測

搜尋 Plugin

medium

high

high

high

high

high