CVE-2015-2080

EPSS 74.9%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 74.9%KEV nãoPoC públicaNuclei simMetasploit —Patch referenciado

Lifecycle

17 Feb 2016Public PoC

07 Oct 2016Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.htmlunverified exploitdbwww.exploit-db.com/exploits/39455unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html http://seclists.org/fulldisclosure/2015/Mar/12 https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md https://security.netapp.com/advisory/ntap-20190307-0005/http://www.securityfocus.com/archive/1/534755/100/1600/threaded http://www.securityfocus.com/bid/72768 http://www.securitytracker.com/id/1031800