CVE-2024-6763

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/jetty/jetty.project/pull/12012	Patch
https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh	Exploit Mitigation Vendor Advisory
https://gitlab.eclipse.org/security/cve-assignement/-/issues/25	Vendor Advisory
https://security.netapp.com/advisory/ntap-20250306-0005/

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*

History

07 Mar 2025, 01:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20250306-0005/ -

Information

Published : 2024-10-14 16:15

Updated : 2025-03-07 01:15

NVD link : CVE-2024-6763

Mitre link : CVE-2024-6763

CVE.ORG link : CVE-2024-6763

JSON object : View

Products Affected

eclipse

jetty

CWE

CWE-1286

Improper Validation of Syntactic Correctness of Input

NVD-CWE-Other

{"id": "CVE-2024-6763", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-10-14T16:15:04.163", "references": [{"url": "https://github.com/jetty/jetty.project/pull/12012", "tags": ["Patch"], "source": "emo@eclipse.org"}, {"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://security.netapp.com/advisory/ntap-20250306-0005/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-1286"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks."}, {"lang": "es", "value": "Eclipse Jetty es un servidor web y motor de servlets basado en Java, ligero y altamente escalable. Incluye una clase de utilidad, HttpURI, para el an\u00e1lisis de URL/URL. La clase HttpURI realiza una validaci\u00f3n insuficiente en el segmento de autoridad de una URI. Sin embargo, el comportamiento de HttpURI difiere de los navegadores comunes en c\u00f3mo maneja una URI que se considerar\u00eda inv\u00e1lida si se validara completamente contra el RRC. Espec\u00edficamente, HttpURI y el navegador pueden diferir en el valor del host extra\u00eddo de una URI inv\u00e1lida y, por lo tanto, una combinaci\u00f3n de Jetty y un navegador vulnerable puede ser vulnerable a un ataque de redireccionamiento abierto o a un ataque SSRF si la URI se usa despu\u00e9s de pasar las verificaciones de validaci\u00f3n."}], "lastModified": "2025-03-07T01:15:11.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42139A4F-DE37-4B6A-B7AC-6CA22999F733", "versionEndExcluding": "12.0.12", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}