Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
CVSS Information
N/A
Vulnerability Type
在释放前未清除敏感信息
Vulnerability Title
Eclipse Jetty 安全漏洞
Vulnerability Description
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty 存在安全漏洞，该漏洞源于如果启用GZIP请求主体的通货膨胀和来自不同客户端的请求多路复用到一个连接, 攻击者可利用该漏洞可以发送一个请求接收到的身体完全但不被应用程序,然后后续请求在同一连接会发现身体返回它的body。以下产品及版本受到影响：9.4.0.RC0版本至9.4.34.v20201102版本, 10.0.0.alpha0版本至 10.0.0.bet
CVSS Information
N/A
Vulnerability Type
N/A