CVE-2022-2047
Assigner: eclipse
Published: 2022-07-07T20:45:12
State: PUBLISHED
affected: product: Eclipse Jetty
vendor: The Eclipse Foundation
versions: lessThan: unspecified
status: affected
version: 9.4.0
versionType: custom
lessThanOrEqual: 9.4.46
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: affected
version: 10.0.0
versionType: custom
lessThanOrEqual: 10.0.9
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: affected
version: 11.0.0
versionType: custom
lessThanOrEqual: 11.0.9
status: affected
version: unspecified
versionType: custom
descriptions: value: In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: CWE-20
type: CWE