3 results · Clear filters · Feed
-
Medium 6.9
Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
-
Medium 6.9
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constrain…
-
Medium 5.6
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentia…