High severity · published Oct 7, 2016
CVE-2015-2080
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP…
7.5
CVSS
75.4%
EPSS
No
On KEV
Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)75.4% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
22 · source: NVD
JE
Jetty · Eclipse
9.2.3; 9.2.4; 9.2.5; 9.2.6; 9.2.7; 9.2.8; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2080
Vendor Advisory
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
Vendor Advisory
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
Exploit
http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
Exploit
http://seclists.org/fulldisclosure/2015/Mar/12
www.securityfocus.com
http://www.securityfocus.com/archive/1/534755/100/1600/threaded
More from Jetty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…
9.8
CVE-2017-7657
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…
9.8
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other…
9.4
CVE-2019-17638
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error