Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-6763

Summary
Assigner-eclipse
Assigner Org ID-e51fbebd-6053-4e49-959f-1b94eeb69a2c
Published At-14 Oct, 2024 | 15:06
Updated At-07 Mar, 2025 | 00:10
Rejected At-
Credits

Jetty URI parsing of invalid authority

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:eclipse
Assigner Org ID:e51fbebd-6053-4e49-959f-1b94eeb69a2c
Published At:14 Oct, 2024 | 15:06
Updated At:07 Mar, 2025 | 00:10
Rejected At:
▼CVE Numbering Authority (CNA)
Jetty URI parsing of invalid authority

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

Affected Products
Vendor
Eclipse Foundation AISBLEclipse Foundation
Product
Jetty
Collection URL
https://repo.maven.apache.org/maven2/
Package Name
org.eclipse.jetty:jetty-http
Repo
https://github.com/jetty/jetty.project
Modules
  • jetty-http
Default Status
unaffected
Versions
Affected
  • From 7.0.0 through 12.0.11 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-1286CWE-1286
Type: CWE
CWE ID: CWE-1286
Description: CWE-1286
Metrics
VersionBase scoreBase severityVector
3.13.7LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Version: 3.1
Base score: 3.7
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

The attacks outlined above rely on decoded user data being passed to the HttpURI class. Application should not pass decoded user data as an encoded URI to any URI class/method, including HttpURI. Such applications are likely to be vulnerable in other ways. The immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority. Ultimately, Jetty will deprecate and remove support for user info in the authority per RFC9110 Section 4.2.4 https://datatracker.ietf.org/doc/html/rfc9110#section-4.2.4 . Note that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser).

Exploits

Credits

finder
https://github.com/zer0yu
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh
N/A
https://gitlab.eclipse.org/security/cve-assignement/-/issues/25
N/A
https://github.com/jetty/jetty.project/pull/12012
N/A
Hyperlink: https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh
Resource: N/A
Hyperlink: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25
Resource: N/A
Hyperlink: https://github.com/jetty/jetty.project/pull/12012
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Vendor
Eclipse Foundation AISBLeclipse
Product
jetty
CPEs
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Default Status
unaffected
Versions
Affected
  • From 7.0.0 through 12.0.11 (semver)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://security.netapp.com/advisory/ntap-20250306-0005/
N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20250306-0005/
Resource: N/A
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:emo@eclipse.org
Published At:14 Oct, 2024 | 16:15
Updated At:10 Jul, 2025 | 15:04

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.13.7LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary3.15.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Type: Secondary
Version: 3.1
Base score: 3.7
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Type: Primary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CPE Matches

Eclipse Foundation AISBL
eclipse
>>jetty>>Versions from 7.0.0(inclusive) to 9.4.57(exclusive)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-1286Secondaryemo@eclipse.org
NVD-CWE-OtherPrimarynvd@nist.gov
CWE ID: CWE-1286
Type: Secondary
Source: emo@eclipse.org
CWE ID: NVD-CWE-Other
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/jetty/jetty.project/pull/12012emo@eclipse.org
Patch
Third Party Advisory
https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxhemo@eclipse.org
Exploit
Mitigation
Vendor Advisory
https://gitlab.eclipse.org/security/cve-assignement/-/issues/25emo@eclipse.org
Vendor Advisory
https://security.netapp.com/advisory/ntap-20250306-0005/af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Hyperlink: https://github.com/jetty/jetty.project/pull/12012
Source: emo@eclipse.org
Resource:
Patch
Third Party Advisory
Hyperlink: https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh
Source: emo@eclipse.org
Resource:
Exploit
Mitigation
Vendor Advisory
Hyperlink: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25
Source: emo@eclipse.org
Resource:
Vendor Advisory
Hyperlink: https://security.netapp.com/advisory/ntap-20250306-0005/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

8Records found

CVE-2025-6705
Matching Score-8
Assigner-Eclipse Foundation
ShareView Details
Matching Score-8
Assigner-Eclipse Foundation
CVSS Score-7.6||HIGH
EPSS-0.03% / 8.13%
||
7 Day CHG~0.00%
Published-27 Jun, 2025 | 14:57
Updated-31 Jul, 2025 | 16:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new extension versions under any namespace, including those not controlled by an attacker. However, it did not permit deletion of existing extensions, overwriting of published versions, or access to administrative features of the registry. The issue was reported on May 4, 2025, fully resolved by June 24, and followed by a comprehensive audit. No evidence of compromise was found, though 81 extensions were proactively deactivated as a precaution. The standard publishing process remained unaffected. Recommendations have been issued to mitigate similar risks in the future.

Action-Not Available
Vendor-Eclipse Foundation AISBL
Product-open_vsxEclipse Open VSX Registry
CWE ID-CWE-653
Improper Isolation or Compartmentalization
CWE ID-CWE-913
Improper Control of Dynamically-Managed Code Resources
CVE-2024-10917
Matching Score-8
Assigner-Eclipse Foundation
ShareView Details
Matching Score-8
Assigner-Eclipse Foundation
CVSS Score-3.7||LOW
EPSS-0.09% / 25.82%
||
7 Day CHG~0.00%
Published-11 Nov, 2024 | 16:55
Updated-09 Jan, 2025 | 18:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength

In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.

Action-Not Available
Vendor-Eclipse Foundation AISBL
Product-openj9Open J9
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2021-28170
Matching Score-8
Assigner-Eclipse Foundation
ShareView Details
Matching Score-8
Assigner-Eclipse Foundation
CVSS Score-5.3||MEDIUM
EPSS-0.08% / 23.35%
||
7 Day CHG~0.00%
Published-26 May, 2021 | 21:55
Updated-03 Aug, 2024 | 21:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Action-Not Available
Vendor-quarkusOracle CorporationEclipse Foundation AISBL
Product-jakarta_expression_languagecommunications_cloud_native_core_policyweblogic_serverquarkusJakarta Expression Language Implementation
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2025-1007
Matching Score-8
Assigner-Eclipse Foundation
ShareView Details
Matching Score-8
Assigner-Eclipse Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.07% / 20.45%
||
7 Day CHG~0.00%
Published-19 Feb, 2025 | 08:40
Updated-31 Jul, 2025 | 12:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Improper Authorization in /user/namespace/{namespace}/details

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

Action-Not Available
Vendor-Eclipse Foundation AISBL
Product-open_vsxOpenVSX
CWE ID-CWE-283
Unverified Ownership
CWE ID-CWE-285
Improper Authorization
CVE-2022-36022
Matching Score-8
Assigner-GitHub, Inc.
ShareView Details
Matching Score-8
Assigner-GitHub, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.08% / 23.87%
||
7 Day CHG~0.00%
Published-10 Nov, 2022 | 00:00
Updated-23 Apr, 2025 | 16:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use some older NLP examples that reference an old S3 bucket. The problem has been patched. Users should upgrade to snapshots as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.

Action-Not Available
Vendor-Eclipse Foundation AISBL
Product-deeplearning4jdeeplearning4j
CWE ID-CWE-344
Use of Invariant Value in Dynamically Changing Context
CWE ID-CWE-330
Use of Insufficiently Random Values
CVE-2023-40167
Matching Score-8
Assigner-GitHub, Inc.
ShareView Details
Matching Score-8
Assigner-GitHub, Inc.
CVSS Score-5.3||MEDIUM
EPSS-2.54% / 84.87%
||
7 Day CHG~0.00%
Published-15 Sep, 2023 | 19:37
Updated-13 Feb, 2025 | 17:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Jetty accepts "+" prefixed value in Content-Length

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

Action-Not Available
Vendor-Debian GNU/LinuxEclipse Foundation AISBL
Product-debian_linuxjettyjetty.project
CWE ID-CWE-130
Improper Handling of Length Parameter Inconsistency
CVE-2021-41041
Matching Score-8
Assigner-Eclipse Foundation
ShareView Details
Matching Score-8
Assigner-Eclipse Foundation
CVSS Score-5.3||MEDIUM
EPSS-0.08% / 25.37%
||
7 Day CHG~0.00%
Published-27 Apr, 2022 | 02:10
Updated-04 Aug, 2024 | 02:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Action-Not Available
Vendor-Oracle CorporationEclipse Foundation AISBL
Product-java_seopenj9Eclipse OpenJ9
CWE ID-CWE-252
Unchecked Return Value
CWE ID-CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
CWE ID-CWE-908
Use of Uninitialized Resource
CVE-2025-25007
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-5.3||MEDIUM
EPSS-0.08% / 24.72%
||
7 Day CHG~0.00%
Published-12 Aug, 2025 | 17:09
Updated-26 Aug, 2025 | 19:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Microsoft Exchange Server Spoofing Vulnerability

Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Action-Not Available
Vendor-Microsoft Corporation
Product-Microsoft Exchange Server 2019 Cumulative Update 15Microsoft Exchange Server 2019 Cumulative Update 14Microsoft Exchange Server 2016 Cumulative Update 23Microsoft Exchange Server Subscription Edition RTM
CWE ID-CWE-1286
Improper Validation of Syntactic Correctness of Input
Details not found