CVE-2007-6672
Mortbay Jetty Double Slash URI Information Disclosure Vulnerability
CVE-2007-6672 is a medium vulnerability (CVSS 5.0) in Mortbay Jetty Jetty, published January 8, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.97%, the 90th percentile. Fixed in org.mortbay.jetty:jetty 6.1.7.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 3.97%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.1.7org.mortbay.jetty:jetty +1 more
Description
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.mortbay.jetty:jettyMaven | 6.1.5 to 6.1.6 | 6.1.7 |
org.mortbay.jetty:jettyMaven | 6.1.5 up to 6.1.7, plus listed versions 6.1.66.1.6rc06.1.6rc1 | 6.1.7 |
What each source reports
NVD Score used
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
- Record
CVE-2007-6672- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
- Record
CVE-2007-6672- Updated
- 2026-11-02
EUVDEUVD-2022-2400No score
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
- Record
EUVD-2022-2400- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jjw-xrr6-9v3pNo score
Mortbay Jetty Double Slash URI Information Disclosure Vulnerability
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple / (slash) characters in the URI.
- Record
GHSA-4jjw-xrr6-9v3p- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-4jjw-xrr6-9v3pNo score
Mortbay Jetty Double Slash URI Information Disclosure Vulnerability
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple / (slash) characters in the URI.
- Record
GHSA-4jjw-xrr6-9v3p- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
jira.codehaus.org/browse/JETTY-386
osvdb.org/39855
vupen.com/english/advisories/2008/0079
igniterealtime.org/community/message/163752
kb.cert.org/vuls/id/553235
Show 9 moreShow less
secunia.com/advisories/28322
securityfocus.com/bid/27117
nvd.nist.gov/vuln/detail/CVE-2007-6672
web.archive.org/web/20080113051254/http://www.kb.cert.org/vuls/id/553235
github.com/advisories/GHSA-4jjw-xrr6-9v3p