CVE-2015-2080
high · 7.5A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
7.5
CVSS
75.4%
EPSS (exploit prob.)
99th
EPSS percentile
2016-10-07
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| fedoraproject | fedora | 22 |
| eclipse | jetty | 9.2.3 |
| eclipse | jetty | 9.2.4 |
| eclipse | jetty | 9.2.5 |
| eclipse | jetty | 9.2.6 |
| eclipse | jetty | 9.2.7 |
| eclipse | jetty | 9.2.8 |
| eclipse | jetty | 9.3.0 |
| eclipse | jetty | 9.3.0 |
Check a specific version with /api/v1/cve/match.
References
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
- http://seclists.org/fulldisclosure/2015/Mar/12
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded
- http://www.securityfocus.com/bid/72768
- http://www.securitytracker.com/id/1031800
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
- https://security.netapp.com/advisory/ntap-20190307-0005/
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
- http://seclists.org/fulldisclosure/2015/Mar/12
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded
- http://www.securityfocus.com/bid/72768
- http://www.securitytracker.com/id/1031800
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
- https://security.netapp.com/advisory/ntap-20190307-0005/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2015-2080