Description
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
None
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
Affected products
- Eclipse Foundation / Eclipse Jetty12.1.0 – 12.1.12
- Eclipse Foundation / Eclipse Jetty12.0.0 – 12.0.38
- Eclipse Foundation / Eclipse Jetty11.0.0 – 11.0.32
- Eclipse Foundation / Eclipse Jetty10.0.0 – 10.0.32
- Eclipse Foundation / Eclipse Jetty9.4.0 – 9.4.64
Updated 44m ago · 8 sources