CVE-2005-3747: Mortbay Jetty Discloses JSP Source Code
Summary
CVE-2005-3747: Mortbay Jetty Discloses JSP Source Code. Affects org.mortbay.jetty:jetty versions < 5.1.6. Fixed in 5.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mortbay Jetty is an open-source web server and servlet container written in Java. It provides a lightweight and scalable platform for hosting Java web applications. Jetty is widely used in various applications and frameworks, including Maven. However, versions prior to 5.1.6 are vulnerable to a security issue that allows remote attackers to obtain the source code of JSP pages. This vulnerability may be exploited by sending requests for .jsp files with URL-encoded backslash (%5C) characters. It is important to note that this vulnerability may have the same impact as CVE-2006-2758.
Vulnerability Detail
The vulnerability in Mortbay Jetty allows remote attackers to access the source code of JSP pages. By sending specially crafted requests for .jsp files with URL-encoded backslash characters, an attacker can bypass security measures and retrieve sensitive information. This can lead to the exposure of proprietary code, credentials, or other confidential data stored within JSP pages. The impact of this vulnerability depends on the nature of the exposed source code and the sensitivity of the information it contains.
How To Fix
Minimum fixed version
5.1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict access to JSP files and directories containing sensitive information. This can be achieved by configuring the web server or application firewall to deny requests for .jsp files from untrusted sources. Additionally, it is advisable to review the source code of JSP pages and remove any sensitive information that should not be exposed.
Conclusion
The Mortbay Jetty vulnerability allows remote attackers to access the source code of JSP pages, potentially exposing sensitive information. To mitigate this risk, it is crucial to upgrade to Jetty version 5.1.6 or later. Restricting access to JSP files and reviewing the source code can also provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.mortbay.jetty:jetty →
FAQ
Mortbay Jetty is an open-source web server and servlet container written in Java. It provides a lightweight and scalable platform for hosting Java web applications.
The vulnerability allows remote attackers to obtain the source code of JSP pages, potentially exposing proprietary code, credentials, or other sensitive information stored within those pages.
To fix this vulnerability, it is recommended to upgrade to Jetty version 5.1.6 or later. This version includes a patch that addresses the issue and prevents the disclosure of JSP source code.
As a temporary workaround, it is recommended to restrict access to JSP files and directories containing sensitive information. Additionally, reviewing the source code of JSP pages and removing any sensitive information can help mitigate the risk.
There is no known exploit available for this vulnerability at the moment. However, it is important to apply the recommended fixes to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.mortbay.jetty:jetty.
