Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.

Mortbay Jetty before 6.1.6rc1 does not properly handle 'certain quote sequences' in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

- Bug #417411 - CVE-2007-5615: jetty CRLF injection

  - Bug #417391 - CVE-2007-5613: jetty cross site scripting

  - Bug #417401 - CVE-2007-5614: jetty session hijacking     issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jul 4 2008 Jeff Johnston <jjohnstn at redhat.com>     5.1.14-1jpp.1

    - Security patch

    - Resolves #417401, #417411, #417391

    - Upgrade to 5.1.14 source tarball for Fedora

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Websphere has been updated to version 2.1.0.1 to fix several security vulnerabilities in the included subprojects, such as Apache Geronimo and Tomcat. (CVE-2007-0184 / CVE-2007-0185 / CVE-2007-2377 / CVE-2007-2449 / CVE-2007-2450 / CVE-2007-3382 / CVE-2007-3385 / CVE-2007-3386 / CVE-2007-5333 / CVE-2007-5342 / CVE-2007-5461 / CVE-2007-5613 / CVE-2007-5615 / CVE-2007-6286 / CVE-2008-0002 / CVE-2008-1232 / CVE-2008-1947 / CVE-2008-2370 / CVE-2008-2938)

The remote host is running Jetty, a Java web server that can be downloaded off the Internet and is currently bundled with some IBM applications.  This version of Jetty is vulnerable to a remote flaw in the way that it handles cookie quotes.  An attacker exploiting this flaw would be able to hijack the session of valid users without authentication.  Further, this version of Jetty is vulnerable to a flaw in the way that it handles Carriage-Return/Line-Feed characters.  An attacker can exploit this flaw to inject malicious HTTP headers into a session.  This version of Jetty is also vulnerable to a cross-site scripting (XSS) attack that would allow an attacker to possibly retrieve sensitive data from client browsers.

ID	名稱	產品	系列	已發布	已更新	嚴重性
29288	FreeBSD : jetty -- multiple vulnerabilities (6ae7cef2-a6ae-11dc-95e6-000c29c5647f)	Nessus	FreeBSD Local Security Checks	2007/12/11	2021/1/6	high
33417	Fedora 9 : jetty-5.1.14-1jpp.2.fc9 (2008-6141)	Nessus	Fedora Local Security Checks	2008/7/8	2021/1/11	high
33418	Fedora 8 : jetty-5.1.14-1jpp.1.fc8 (2008-6164)	Nessus	Fedora Local Security Checks	2008/7/8	2021/1/11	high
41596	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 5850)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
4307	Jetty < 6.1.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2007/12/4	2019/3/6	medium

偵測

搜尋 Plugin

high

high

high

high

medium