CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

CVSS v3.0 NVD

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

75.44% chance of exploitation in the next 30 days, 100th percentile

Nuclei

high · CWE-200

Published

2016-10-07

Updated

2024-08-06

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
• http://seclists.org/fulldisclosure/2015/Mar/12
• https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-share…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2080.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/39455

Security advisories

• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
• eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-blee…
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
• http://www.securitytracker.com/id/1031800
• advisories/GHSA-ghgj-3xqr-6jfm
• http://www.securityfocus.com/bid/72768

References

• CVE Record
• NVD entry