Description
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.mortbay.jetty:jetty | >= 6.1.5, < 6.1.7 | 6.1.7 | GHSA-4jjw-xrr6-9v3p |
References
- http://jira.codehaus.org/browse/JETTY-386#action_117699
- 39855 vdb-entry
- ADV-2008-0079 vdb-entry
- http://www.igniterealtime.org/community/message/163752
- http://jira.codehaus.org/browse/JETTY/fixforversion/13950
- VU#553235 third-party-advisory
- 28322 third-party-advisory
- 28547 third-party-advisory
- 27117 vdb-entry