Description
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.mortbay.jetty:jetty | < 6.1.6 | 6.1.6 | GHSA-fvh3-4v5r-cvvc |
References
- FEDORA-2008-6141 vendor-advisory
- FEDORA-2008-6164 vendor-advisory
- 30941 third-party-advisory
- VU#438616 third-party-advisory
- 26695 vdb-entry
- 35143 third-party-advisory
- 27925 third-party-advisory
- 42496 vdb-entry
- http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt