DocumentationSeverity
6.9
Medium severity
Details
- CVSS score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
In Eclipse Jetty, across various versions ofjetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.
Details
- Affected product:
- Apache CXF , Apache Commons , Apache Hadoop , Apache Hive , Apache Kafka , Apache Lucene , Apache Solr , Apache Spark , Apache Tapestry , CometD , Eclipse Jetty , Elasticsearch , Hazelcast , Spring , activemq , agepredictor , airlift , alluxio , artemis , athenz , avro , aws-sdk-java-v2 , bookkeeper , camel , client_java , console , debezium , directory-server , discovery , druid , flume , geronimo-xbean , gwt , gwtp , hapi-fhir , hbase , hbase-thirdparty , htmlunit , ignite , incubator-retired-htrace , io.airlift:jmx , io.airlift:jmx-http , java-cas-client , jena , jersey , jgit , jsonpath , kite , logging-flume , logging-flume-irc , metrics , micrometer , micrometer-tracing , mustache.java , neo4j , neo4j-ogm , opencensus-java , pravega , pulsar , selenium , signalfx-java , tika , tinkerpop , trino , wiremock , zookeeper
- Affected packages:
- apache-jsp @ 9.4.65 (+22540 more)