Search for vulnerabilities
Vulnerability details: VCID-he24-1471-subv
Vulnerability ID VCID-he24-1471-subv
Aliases CVE-2022-2047
GHSA-cj7v-27pg-wf7q
Summary Jetty invalid URI parsing may produce invalid HttpURI.authority ### Description URI use within Jetty's `HttpURI` class can parse invalid URIs such as `http://localhost;/path` as having an authority with a host of `localhost;`. A URIs of the type `http://localhost;/path` should be interpreted to be either invalid or as `localhost;` to be the userinfo and no host. However, `HttpURI.host` returns `localhost;` which is definitely wrong. ### Impact This can lead to errors with Jetty's `HttpClient`, and Jetty's `ProxyServlet` / `AsyncProxyServlet` / `AsyncMiddleManServlet` wrongly interpreting an authority with no host as one with a host. ### Patches Patched in PR [#8146](https://github.com/eclipse/jetty.project/pull/8146) for Jetty version 9.4.47. Patched in PR [#8014](https://github.com/eclipse/jetty.project/pull/8015) for Jetty versions 10.0.10, and 11.0.10 ### Workarounds None. ### For more information If you have any questions or comments about this advisory: * Email us at security@webtide.com.
Status Published
Exploitability 0.5
Weighted Severity 2.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 2.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2047.json
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01221 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01225 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01225 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01225 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
epss 0.01225 https://api.first.org/data/v1/epss?cve=CVE-2022-2047
cvssv3.1 2.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr LOW https://github.com/advisories/GHSA-cj7v-27pg-wf7q
cvssv3.1 2.7 https://github.com/eclipse/jetty.project
generic_textual LOW https://github.com/eclipse/jetty.project
cvssv3.1 2.7 https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
cvssv3.1_qr LOW https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
generic_textual LOW https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
cvssv3.1 2.7 https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
generic_textual LOW https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
cvssv3.1 2.7 https://nvd.nist.gov/vuln/detail/CVE-2022-2047
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2022-2047
cvssv3.1 2.7 https://security.netapp.com/advisory/ntap-20220901-0006
generic_textual LOW https://security.netapp.com/advisory/ntap-20220901-0006
cvssv3.1 2.7 https://www.debian.org/security/2022/dsa-5198
generic_textual LOW https://www.debian.org/security/2022/dsa-5198
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2047.json
https://api.first.org/data/v1/epss?cve=CVE-2022-2047
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2047
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2048
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/eclipse/jetty.project
https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
https://nvd.nist.gov/vuln/detail/CVE-2022-2047
https://security.netapp.com/advisory/ntap-20220901-0006
https://security.netapp.com/advisory/ntap-20220901-0006/
https://www.debian.org/security/2022/dsa-5198
2116949 https://bugzilla.redhat.com/show_bug.cgi?id=2116949
GHSA-cj7v-27pg-wf7q https://github.com/advisories/GHSA-cj7v-27pg-wf7q
RHSA-2023:0189 https://access.redhat.com/errata/RHSA-2023:0189
RHSA-2023:1661 https://access.redhat.com/errata/RHSA-2023:1661
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2047.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/eclipse/jetty.project
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-2047
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://security.netapp.com/advisory/ntap-20220901-0006
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Found at https://www.debian.org/security/2022/dsa-5198
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78184
EPSS Score 0.01221
Published At July 8, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:25:27.717319+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-cj7v-27pg-wf7q/GHSA-cj7v-27pg-wf7q.json 36.1.3