VulnerableCode Package Details - pkg:maven/org.eclipse.jetty/jetty-server@8.1.10.v20130312

Vulnerabilities affecting this package (19)

Advisory	Summary	Fixed in package version
CVE-2019-10241	In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS …	9.4.17.v20190418 Vulnerable 9.4.18.v20190429 Vulnerable 9.4.19.v20190610 Vulnerable 9.4.20.v20190813 Vulnerable 9.4.21.v20190926 Vulnerable 9.4.24.v20191120 Vulnerable 9.4.25.v20191220 Vulnerable 9.4.26.v20200117 Vulnerable 9.4.27.v20200227 Vulnerable 9.4.28.v20200408 Vulnerable 9.4.29.v20200521 Vulnerable 9.2.28.v20190418 Vulnerable
GHSA-6x9x-8qw9-9pp6 Aliases: CVE-2017-7658	Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling) Eclipse Jetty Server versions 9.2.x and …	9.2.25.v20180606 Vulnerable
GHSA-26vr-8j45-3r4w Aliases: CVE-2021-28165	Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources ### Impact When using SSL/TLS with Jetty, …	There are no reported fixed by versions.
GHSA-p26g-97m4-6q7c Aliases: CVE-2023-26049	Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies Nonstandard cookie parsing in Jetty may allow …	9.4.51.v20230217 Vulnerable
GHSA-qw69-rqj8-6qw8 Aliases: CVE-2023-26048	OutOfMemoryError for large multipart without filename in Eclipse Jetty ### Impact Servlets with multipart support (e.g. annotated with `@MultipartConfig`) that …	9.4.51.v20230217 Vulnerable
CVE-2019-10247	Information Exposure In Eclipse Jetty, the server running on any OS and Jetty version combination will reveal the configured fully …	9.4.17.v20190418 Vulnerable 9.2.28.v20190418 Vulnerable 9.3.27.v20190418 Vulnerable
CVE-2021-34428 Aliases: GHSA-m6cp-vxjx-65j6	Insufficient Session Expiration If an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in …	10.0.3 Vulnerable 11.0.3 Vulnerable 9.4.40.v20210413 Vulnerable
CVE-2023-26049 Aliases: GHSA-p26g-97m4-6q7c	Exposure of Sensitive Information to an Unauthorized Actor Jetty is a java based web server and servlet engine. Nonstandard cookie …	9.4.51.v20230217 Vulnerable 10.0.14 Vulnerable 11.0.14 Vulnerable 12.0.1 Vulnerable
CVE-2021-28165 Aliases: GHSA-26vr-8j45-3r4w	Uncontrolled Resource Consumption In Eclipse Jetty to alpha0 to alpha0 to, CPU usage can reach % upon receiving a large …	10.0.2 Vulnerable 11.0.2 Vulnerable 9.4.39.v20210325 Vulnerable
CVE-2020-27216	Creation of Temporary File in Directory with Insecure Permissions In Eclipse Jetty on Unix like systems, the system's temporary directory …	9.4.33.v20201020 Vulnerable 10.0.0.beta3 Not vulnerable 11.0.0.beta3 Not vulnerable
GHSA-ghgj-3xqr-6jfm Aliases: CVE-2015-2080	Jetty vulnerable to exposure of sensitive information to unauthenticated remote users The exception handling code in Eclipse Jetty prior to …	9.2.9.v20150224 Vulnerable 9.2.9.v20150224 Vulnerable
CVE-2017-7658	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) If an intermediary decided on the shorter length, but still passed on …	9.4.11.v20180605 Vulnerable 9.3.24.v20180605 Vulnerable 9.2.26.v20180806 Vulnerable 9.4.11.v20180605 Vulnerable 9.3.24.v20180605 Vulnerable 9.2.26.v20180806 Vulnerable
CVE-2017-7656	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Eclipse Jetty contains a vulnerability that could be used to poison the …	9.4.11.v20180605 Vulnerable 9.3.24.v20180605 Vulnerable 9.2.26.v20180806 Vulnerable 9.4.11.v20180605 Vulnerable 9.3.24.v20180605 Vulnerable 9.2.26.v20180806 Vulnerable
GHSA-vgg8-72f2-qm23 Aliases: CVE-2017-7657	Critical severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The …	9.2.25.v20180606 Vulnerable 9.3.24.v20180605 Vulnerable 9.2.25.v20180606 Vulnerable
GHSA-wfcc-pff6-rgc5 Aliases: CVE-2017-9735	Jetty vulnerable to exposure of sensitive information due to observable discrepancy Jetty through 9.4.x contains a timing channel attack in …	9.4.6.v20170531 Vulnerable 9.3.20.v20170531 Vulnerable 9.2.22.v20170606 Vulnerable 9.2.22.v20170606 Vulnerable
GHSA-84q7-p226-4x5w Aliases: CVE-2017-7656	Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling) Eclipse Jetty, versions 9.2.x and older, …	9.3.24.v20180605 Vulnerable 9.4.11.v20180605 Vulnerable 9.3.24.v20180605 Vulnerable 9.4.11.v20180605 Vulnerable 9.3.24.v20180605 Vulnerable
GHSA-m6cp-vxjx-65j6 Aliases: CVE-2021-34428	SessionListener can prevent a session from being invalidated breaking logout ### Impact If an exception is thrown from the `SessionListener#sessionDestroyed()` …	10.0.3 Vulnerable 11.0.3 Vulnerable
GHSA-xc67-hjx6-cgg6 Aliases: CVE-2019-10247	Installation information leak in Eclipse Jetty In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 …	9.2.28.v20190418 Vulnerable 9.3.27.v20190418 Vulnerable 9.4.17.v20190418 Vulnerable 9.2.28.v20190418 Vulnerable
GHSA-7vx9-xjhr-rw6h Aliases: CVE-2019-10241	Cross-site Scripting in Eclipse Jetty In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the …	9.2.27.v20190403 Vulnerable 9.3.26.v20190403 Vulnerable 9.4.16.v20190411 Vulnerable 9.2.27.v20190403 Vulnerable 9.3.26.v20190403 Vulnerable 9.4.16.v20190411 Vulnerable 9.2.27.v20190403 Vulnerable

Next non-vulnerable version	10.0.0.beta3
Latest non-vulnerable version	12.1.10
Risk score	10.0