« Back to list

CVE-2007-5614

Status: ModifiedHigh (7.5)—

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Mortbay Jetty — Jetty

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2007-5614",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-12-05T11:46:00.000",
  "references": [
    {
      "url": "http://osvdb.org/42496",
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/27925",
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/30941",
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/35143",
      "source": "cret@cert.org"
    },
    {
      "url": "http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/438616",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26695",
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html",
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html",
      "source": "cret@cert.org"
    },
    {
      "url": "http://osvdb.org/42496",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27925",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30941",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35143",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/438616",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26695",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mortbay Jetty before 6.1.6rc1 does not properly handle \"certain quote sequences\" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Mortbay Jetty anterior a 6.1.6rc1 no maneja adecuadamente \"ciertas secuencias de comillas\" en parámetros de cookie HTML, lo cual permite a atacantes remotos secuestrar sesiones del navegador mediante vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T22:46:29.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3615D01B-ACAD-41A1-B7EA-80C63AE01877"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6CCB1E1-6299-44EC-B128-5AE3C54F5A94"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50463525-3D63-4048-8A59-B0EB4C23FE1D"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6785E68-F28C-48C6-9D1F-0C0E4EB4086F"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CC455AC-A31B-4D29-8CDD-A9EB3F2C3E8D"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "705ACD64-FF30-48EA-A003-9F0AD999B197"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79E38FDC-7937-4294-B1B3-48B1DA23F89B"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FD8FCEE-0E01-46A9-905A-E0A681650915"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D250D764-C503-4CC9-8D46-635561E6A7C4"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A6BCC46-43E3-4678-BA4E-7CEA8211C713"
            },
            {
              "criteria": "cpe:2.3:a:mortbay_jetty:jetty:6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BD8360D-1C7D-466F-85CB-FAECDB99137D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}