Description
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://jira.codehaus.org/browse/JETTY-386#action_117699 ↗
- http://osvdb.org/39855 ↗
- http://www.vupen.com/english/advisories/2008/0079 ↗
- http://www.igniterealtime.org/community/message/163752 ↗
- http://jira.codehaus.org/browse/JETTY/fixforversion/13950 ↗
- http://www.kb.cert.org/vuls/id/553235 ↗
- http://secunia.com/advisories/28322 ↗
- http://secunia.com/advisories/28547 ↗
- http://www.securityfocus.com/bid/27117 ↗