CVE-2023-41900
published 2023-09-15CVE-2023-41900: Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.75%
50.9th percentile
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | jetty9 | < jetty9 9.4.50-4+deb12u1 (bookworm) | jetty9 9.4.50-4+deb12u1 (bookworm) |
| eclipse | jetty | >= 10.0.0 < 10.0.16 | 10.0.16 |
| eclipse | jetty | >= 11.0.0 < 11.0.16 | 11.0.16 |
| eclipse | jetty | >= 9.4.21 < 9.4.52 | 9.4.52 |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv4.3MEDIUM
vendor_debian3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jetty: OpenId Revoked authentication allows one request
vendor_redhat·2023-09-14·CVSS 3.5
CVE-2023-41900 [LOW] CWE-1390 jetty: OpenId Revoked authentication allows one request
jetty: OpenId Revoked authentication allows one request
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is c
Debian
CVE-2023-41900: jetty9 - Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4...
vendor_debian·2023·CVSS 3.5
CVE-2023-41900 [LOW] CVE-2023-41900: jetty9 - Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4...
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versi
GHSA
Jetty's OpenId Revoked authentication allows one request
ghsa·2023-09-15
CVE-2023-41900 [LOW] CWE-1390 Jetty's OpenId Revoked authentication allows one request
Jetty's OpenId Revoked authentication allows one request
If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated.
So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`.
### Impact
This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users.
### Original Report
> working on a custom OpenIdAuthenticator, I discovered th
OSV
Jetty's OpenId Revoked authentication allows one request
osv·2023-09-15
CVE-2023-41900 [LOW] Jetty's OpenId Revoked authentication allows one request
Jetty's OpenId Revoked authentication allows one request
If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated.
So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`.
### Impact
This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users.
### Original Report
> working on a custom OpenIdAuthenticator, I discovered th
OSV
CVE-2023-41900: Jetty is a Java based web server and servlet engine
osv·2023-09-15·CVSS 4.3
CVE-2023-41900 [MEDIUM] CVE-2023-41900: Jetty is a Java based web server and servlet engine
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/eclipse/jetty.project/pull/9528https://github.com/eclipse/jetty.project/pull/9660https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48https://security.netapp.com/advisory/ntap-20231110-0004/https://www.debian.org/security/2023/dsa-5507https://github.com/eclipse/jetty.project/pull/9528https://github.com/eclipse/jetty.project/pull/9660https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48https://security.netapp.com/advisory/ntap-20231110-0004/https://www.debian.org/security/2023/dsa-5507
2023-09-15
Published