CVE-2017-7658 is a critical vulnerability in Eclipse Jetty Server versions 9.2.x, 9.3.x, and 9.4.x, affecting products from vendors like Debian, HP, NetApp, and Oracle. It arises from Jetty's improper handling of conflicting HTTP headers, specifically when presented with multiple content-length headers or a content-length and chunked encoding header. This flaw allows an attacker to bypass authorization mechanisms by crafting a "pipelined" request that an intermediary might misinterpret, leading to unauthorized access. With a CVSS score of 9.8 (CRITICAL), it has a high potential for impact (confidentiality, integrity, availability) and is easily exploitable over the network with low attack complexity. While there are no known active exploits, public exploit code, or significant community discussion, its high FAUCET Risk Score of 87/100 indicates a substantial threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.2.26CPE matchmatch criteria | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | ||
>= 9.3.0, < 9.3.24CPE matchmatch criteria | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | ||
>= 9.4.0, < 9.4.11CPE matchmatch criteria | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
11.2.0.4CPE matchmatch criteria | cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.