#VU13528 Information disclosure in Jetty - CVE-2017-7657

Vulnerability identifier: #VU13528

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7657

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jetty
Server applications / Web servers

Vendor: Eclipse

Description

The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of queries that do not match the dynamic URL pattern for webapps that use default error handling settings. A remote attacker can send a query that submits malicious input, trigger a java.nio.file.InvalidPathException message, which could allow the attacker to view sensitive information, such as the software installation path.

Mitigation
The vulnerability is addressed in the versions 9.3.24.v20180605 and 9.4.11.v20180605.

Vulnerable software versions

Jetty: 9.2.0.v20140526 - 9.4.8.v20171121

---

External links
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00123.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.