CVE-2007-5614 Improper Authentication in Mortbay Jetty
Remote attackers can hijack browser sessions by exploiting improper handling of quote sequences in HTML cookie parameters in Mortbay Jetty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-5614?
CVE-2007-5614 is a high-severity vulnerability in n/a, published on 5 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Which versions are affected by CVE-2007-5614?
2 open source packages ship an affected version, including org.mortbay.jetty:jetty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.mortbay.jetty:jetty Maven | All versions | 6.1.6 |
org.mortbay.jetty:jetty Maven | All versions | 6.1.6 |
Products include Mortbay Jetty Jetty.
How do I fix CVE-2007-5614?
Upgrade org.mortbay.jetty:jetty to 6.1.6 or later.
Is CVE-2007-5614 being exploited?
There is no known exploitation of CVE-2007-5614 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fvh3-4v5r-cvvc.