CVE-2015-2080 Jetty vulnerable to exposure of sensitive information to unauthenticated remote users
HighCVSS 7.5
EPSS 75.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | <= 9.2.8.v20150217 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | < 9.2.9.v20150224 | 9.2.9.v20150224 |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC6 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.v20091005 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.1.v20091125 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.2.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.2.v20100331 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.v20100505 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.1.v20100517 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.2.v20100523 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.3.v20100526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.4.v20100610 | No fix listed |
Show 139 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.5.v20100705 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.6.v20100715 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.0.v20101020 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.1.v20101111 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.2.v20101205 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.3.0.v20110203 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.3.1.v20110307 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.0.v20110414 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.1.v20110513 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.2.v20110526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.3.v20110701 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.4.v20110707 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.5.v20110725 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.v20110901 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.1.v20110908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.2.v20111006 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.3.v20111011 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.4.v20111024 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.v20120127 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.1.v20120215 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.10.v20130312 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.11.v20130520 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.12.v20130726 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.13.v20130916 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.14.v20131031 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.15.v20140411 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.16.v20140903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.17.v20150415 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.18.v20150929 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.19.v20160209 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.2.v20120308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.20.v20160902 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.21.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.3.v20120416 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.4.v20120524 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.5.v20120716 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.6.v20120903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.7.v20120910 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.8.v20121106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.9.v20130131 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.v20110901 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.1.v20110908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.2.v20111006 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.3.v20111011 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.4.v20111024 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.v20120127 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.1.v20120215 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.10.v20130312 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.11.v20130520 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.12.v20130726 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.13.v20130916 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.14.v20131031 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.15.v20140411 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.16.v20140903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.17.v20150415 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.18.v20150929 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.19.v20160209 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.2.v20120308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.20.v20160902 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.21.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.22.v20160922 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.3.v20120416 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.4.v20120524 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.5.v20120716 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.6.v20120903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.7.v20120910 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.8.v20121106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.9.v20130131 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.2.0.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.v20130308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.1.v20130408 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.2.v20130417 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.3.v20130506 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.4.v20130625 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.5.v20130815 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.6.v20130930 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.7.v20131107 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.v20131115 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.1.v20140108 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.2.v20140210 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.3.v20140225 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.4.v20140401 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.5.v20140505 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.6.v20160112 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.v20140526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.1.v20140609 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.2.v20140723 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.3.v20140905 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.4.v20141103 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.5.v20141112 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.6.v20141205 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.7.v20150116 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.8.v20150217 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| eclipse jetty | = 9.2.3 | No fix listed |
| eclipse jetty | = 9.2.4 | No fix listed |
| eclipse jetty | = 9.2.5 | No fix listed |
| eclipse jetty | = 9.2.6 | No fix listed |
| eclipse jetty | = 9.2.7 | No fix listed |
| eclipse jetty | = 9.2.8 | No fix listed |
| eclipse jetty | = 9.3.0-m0 | No fix listed |
| eclipse jetty | = 9.3.0-m1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- blog.gdssecurity.com exploit third-party-advisory
- github.com vendor-advisory
- github.com exploit vendor-advisory
- security.netapp.com
- [jetty-announce] 20150224 Critical Security Release of Jetty 9.2.9.v20150224 mailing-list vendor-advisory
- [jetty-announce] 20150225 CVE-2015-2080 : JetLeak Vulnerability Remote Leakage of Shared Buffers in Jetty mailing-list vendor-advisory
- FEDORA-2015-2673 third-party-advisory vendor-advisory
- packetstormsecurity.com exploit third-party-advisory
- 20150301 GDS Labs Alert [CVE-2015-2080] - JetLeak Vulnerability: Remote Leakage Of Shared Buffers In Jetty Web Server exploit mailing-list third-party-advisory
- 20150225 GDS Labs Alert [CVE-2015-2080] - JetLeak Vulnerability: Remote Leakage Of Shared Buffers In Jetty Web Server mailing-list
- 72768 broken-link vdb-entry
- 1031800 third-party-advisory vdb-entry