Search for vulnerabilities
Vulnerability details: VCID-7txr-tcp6-aaah
Vulnerability ID VCID-7txr-tcp6-aaah
Aliases CVE-2015-2080
GHSA-ghgj-3xqr-6jfm
Summary Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
generic_textual HIGH http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
cvssv3.1 7.5 http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
generic_textual HIGH http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
cvssv3.1 7.5 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
generic_textual HIGH http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
cvssv3.1 7.5 http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
generic_textual HIGH http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
epss 0.87207 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.87207 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.87207 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.87207 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.90878 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.91469 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92414 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92645 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92815 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92996 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92996 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.92996 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
epss 0.94844 https://api.first.org/data/v1/epss?cve=CVE-2015-2080
cvssv3.1 7.5 https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
generic_textual HIGH https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=1196254
cvssv3.1 7.5 http://seclists.org/fulldisclosure/2015/Mar/12
generic_textual HIGH http://seclists.org/fulldisclosure/2015/Mar/12
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-ghgj-3xqr-6jfm
cvssv3.1 7.5 https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
generic_textual HIGH https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2015-2080
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2015-2080
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20190307-0005
generic_textual HIGH https://security.netapp.com/advisory/ntap-20190307-0005
cvssv3.1 7.5 http://www.securityfocus.com/archive/1/534755/100/1600/threaded
generic_textual HIGH http://www.securityfocus.com/archive/1/534755/100/1600/threaded
cvssv3.1 7.5 http://www.securityfocus.com/bid/72768
generic_textual HIGH http://www.securityfocus.com/bid/72768
cvssv3.1 7.5 http://www.securitytracker.com/id/1031800
generic_textual HIGH http://www.securitytracker.com/id/1031800
Reference id Reference type URL
http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
http://eclipse.org/jetty/documentation/current/security-reports.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-2080.json
https://api.first.org/data/v1/epss?cve=CVE-2015-2080
https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
http://seclists.org/fulldisclosure/2015/Mar/12
https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
https://github.com/eclipse/jetty.project/commit/3e7b5f0fa918633ec24bd1bc23d6ee76d32c7729
https://github.com/eclipse/jetty.project/commit/4df5647f6dfdc5fa7abb812afe9290d60b17c098
https://github.com/GDSSecurity/Jetleak-Testing-Script
https://security.netapp.com/advisory/ntap-20190307-0005
https://security.netapp.com/advisory/ntap-20190307-0005/
http://www.securityfocus.com/archive/1/534755/100/1600/threaded
http://www.securityfocus.com/bid/72768
http://www.securitytracker.com/id/1031800
1196254 https://bugzilla.redhat.com/show_bug.cgi?id=1196254
cpe:2.3:a:eclipse:jetty:9.2.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.2.3:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.2.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.2.4:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.2.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.2.5:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.2.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.2.6:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.2.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.2.7:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.2.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.2.8:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
CVE-2015-2080 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/39455.txt
CVE-2015-2080 https://nvd.nist.gov/vuln/detail/CVE-2015-2080
CVE-2015-2080 Exploit http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5306.php
GHSA-ghgj-3xqr-6jfm https://github.com/advisories/GHSA-ghgj-3xqr-6jfm
Data source Exploit-DB
Date added Feb. 18, 2016
Description Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers
Ransomware campaign use Unknown
Source publication date Feb. 17, 2016
Exploit type remote
Platform multiple
Source update date Feb. 18, 2016
Source URL http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5306.php
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://seclists.org/fulldisclosure/2015/Mar/12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-2080
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-2080
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20190307-0005
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.securityfocus.com/archive/1/534755/100/1600/threaded
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.securityfocus.com/bid/72768
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.securitytracker.com/id/1031800
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.98877
EPSS Score 0.87207
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.