description: In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
problem types: CWE-20
affected:
{
product: Eclipse Jetty
vendor: The Eclipse Foundation
versions:
lessThan: unspecified, status: affected, version: 9.4.0, versionType: custom
lessThanOrEqual: 9.4.46, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 10.0.0, versionType: custom
lessThanOrEqual: 10.0.9, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 11.0.0, versionType: custom
lessThanOrEqual: 11.0.9, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]