CVE-2024-6763— Eclipse Jetty 安全漏洞

Jetty URI parsing of invalid authority

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-1286

Eclipse Jetty 安全漏洞

Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty 7.0.0到12.0.11版本存在安全漏洞，该漏洞源于HttpURI类对URI的authority部分进行不足的验证，可能会导致开放重定向攻击或服务端请求伪造攻击。

N/A

N/A