CVE-2007-5614

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-12-05 · updated 2026-06-16

Description

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

Affected products

Mortbay Jetty Jetty: 1.0, 2.4, 3.0, 3.1, 4.0, 4.1 (+5)

References

http://osvdb.org/42496
http://secunia.com/advisories/27925
http://secunia.com/advisories/30941
http://secunia.com/advisories/35143
http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
http://www.kb.cert.org/vuls/id/438616
http://www.securityfocus.com/bid/26695
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html
http://osvdb.org/42496
http://secunia.com/advisories/27925
http://secunia.com/advisories/30941

Get alerted when CVE-2007-5614 or the next vulnerability affects your stack