GitHub Advisoryadvisory · Maven

GHSA-qmgj-5h75-jr67 Jetty Directory Traversal Vulnerability

MEDIUM Published 2022-05-01 Modified 2024-02-12 Official page ↗
Aliases
CVE-2006-2758
Ecosystem
Maven
Packages
org.mortbay.jetty:jetty
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2024-02-12

Affected packages

• Maven org.mortbay.jetty:jetty: <= 6.0.beta16 (no fix yet)

Description

Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a `%2e%2e%5c` (encoded `../`) in the URL. NOTE: this might be the same issue as CVE-2005-3747.

Related

Alias · CVE (1)

  • CVE-2006-2758 Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References