CVE-2015-2080

EPSS 74.9%

Vexday Risk Score

60Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 74.9%KEV nãoPoC públicaNuclei simMetasploit —Patch referenciado

Ciclo de vida

17 feb 2016PoC pública

07 oct 2016Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2

cve_referencepacketstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.htmlno verificado exploitdbwww.exploit-db.com/exploits/39455no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html http://seclists.org/fulldisclosure/2015/Mar/12 https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md https://security.netapp.com/advisory/ntap-20190307-0005/http://www.securityfocus.com/archive/1/534755/100/1600/threaded http://www.securityfocus.com/bid/72768 http://www.securitytracker.com/id/1031800