CVE-2023-26049 — Sensitive Information Exposure in Jetty.project

CWE-200 — Sensitive Information ExposureCWE-1286 — Improper Validation of Syntactic Correctness of Input9 documents7 sources
Severity
5.3MEDIUMNVD
CNA2.4
EPSS
0.3%
top 42.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Eclipse Jetty.projectEclipse JettyDebian Linux+1 more
Timeline
PublishedApr 18
Latest updateOct 15

Description

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDeclipse/jetty10.0.0 — 10.0.14+3
▶CVEListV5eclipse/jetty.project< 9.4.51+3

Also affects: Debian Linux 10.0, 11.0, 12.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies↗2023-04-18
▶
OSV
CVE-2023-26049: Jetty is a java based web server and servlet engine↗2023-04-18
▶
CVEList
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty↗2023-04-18
▶
GHSA
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies↗2023-04-18
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle REST Data Services Risk Matrix: ORDS (Eclipse Jetty) — CVE-2023-26049↗2023-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Installation (Eclipse Jetty) — CVE-2023-26049↗2023-07-15
▶
Red Hat
jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies↗2023-04-18
▶
Debian
CVE-2023-26049: jetty9 - Jetty is a java based web server and servlet engine. Nonstandard cookie parsing ...↗2023
▶