« Volver al listado

CVE-2007-5614

Estado: ModificadaAlta (7.5)—

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mortbay Jetty — Jetty

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5614",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-12-05T11:46:00.000",
  "references": [
    {
      "url": "http://osvdb.org/42496",
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/27925",
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/30941",
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/35143",
      "source": "cret@cert.org"
    },
    {
      "url": "http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/438616",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26695",
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html",
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html",
      "source": "cret@cert.org"
    },
    {
      "url": "http://osvdb.org/42496",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27925",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30941",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35143",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/438616",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26695",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mortbay Jetty before 6.1.6rc1 does not properly handle \"certain quote sequences\" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Mortbay Jetty anterior a 6.1.6rc1 no maneja adecuadamente \"ciertas secuencias de comillas\" en parámetros de cookie HTML, lo cual permite a atacantes remotos secuestrar sesiones del navegador mediante vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T22:46:29.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3615D01B-ACAD-41A1-B7EA-80C63AE01877"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6CCB1E1-6299-44EC-B128-5AE3C54F5A94"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50463525-3D63-4048-8A59-B0EB4C23FE1D"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6785E68-F28C-48C6-9D1F-0C0E4EB4086F"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CC455AC-A31B-4D29-8CDD-A9EB3F2C3E8D"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "705ACD64-FF30-48EA-A003-9F0AD999B197"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79E38FDC-7937-4294-B1B3-48B1DA23F89B"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FD8FCEE-0E01-46A9-905A-E0A681650915"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D250D764-C503-4CC9-8D46-635561E6A7C4"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A6BCC46-43E3-4678-BA4E-7CEA8211C713"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BD8360D-1C7D-466F-85CB-FAECDB99137D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}