CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

74.88% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-200

Published

2016-10-07

Updated

2024-08-06

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
• http://seclists.org/fulldisclosure/2015/Mar/12
• https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-share…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2080.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/39455

References

• CVE Record
• NVD entry

Related

• CVE-2015-2071
• CVE-2015-2084
• CVE-2015-2070
• CVE-2015-2090
• CVE-2015-2068
• CVE-2015-2094