CVE-2007-5615

Description

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

How to fix CVE-2007-5615

To remediate CVE-2007-5615, upgrade the affected package to a fixed version below.

• Maven/org.mortbay.jetty:jetty—upgrade to 6.1.6rc0 or later

Is CVE-2007-5615 being exploited?

Low — EPSS is 3.6%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 6.1.6rc0

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2007-5615
• WEBlists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
• WEBwww.kb.cert.org/vuls/id/212984
• WEBgithub.com/jetty-project/codehaus-jetty6/commit/0d2592ea3183914163d0921e4855bd3e18582a05