Information disclosure in Jetty - CVE-2015-2080
Published: April 16, 2018 / Updated: June 17, 2021
Vulnerability identifier: #VU11844
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-2080
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists in an HTTP header, aka JetLeak due to improper initialization of process memory. A remote attacker can gain access to potentially sensitive information.
The weakness exists in an HTTP header, aka JetLeak due to improper initialization of process memory. A remote attacker can gain access to potentially sensitive information.
Affected software
Jetty
Fedora
jetty
Fedora
jetty
How to mitigate CVE-2015-2080
Update to versions 8.2.0-R18, 8.3.0-R11, 8.4.1-R5 or later.
jetty - update to 9.2.9-1.fc22
Links to Public Exploits and PoC-codes
- Exploit #5767 - Nanometrics Centaur 4.3.23 - Unauthenticated Remote Memory Leak (June 17, 2021)
- Exploit #2174 - CVE-2015-2080 (Exploitation and validation tool for CVE 2015-2080 AKA "JetBlead") (March 18, 2020)
- Exploit #1401 - Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers (March 18, 2020)