DocumentationSeverity
8.8
High severity
Details
- CVSS score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
In Eclipse Jetty, across various versions ofjetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1 url-pattern for a servlet, and had a security-constraint applying to only some of those url-pattern definitions.
Details
- Affected product:
- Apache CXF , Apache Commons , Apache Hadoop , Apache Kafka , Apache Lucene , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Hazelcast , Spring , activemq , airlift , alluxio , artemis , athenz , avro , bookkeeper , camel , client_java , console , debezium , flume , geronimo-xbean , gwt , hapi-fhir , hbase , hbase-thirdparty , htmlunit , io.airlift:jmx , io.airlift:jmx-http , java-cas-client , jena , jersey , jgit , logging-flume , logging-flume-irc , metrics , micrometer , micrometer-tracing , pravega , pulsar , selenium , signalfx-java , tika , trino , wiremock , zookeeper
- Affected packages:
- apache-jsp @ 9.4.65 (+16191 more)