CVE-2024-6762 Security Details

CVE ID

CVE-2024-6762

CWE

CWE-400

CWE-770

CVE Description

Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

Published

Oct 16, 2024

CVSS Score & Severity

6.5Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.563%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/eclipse/jetty/ee10/servlets/PushCacheFilter.doFilter(Ljakarta/servlet/ServletRequest;Ljakarta/servlet/ServletResponse;Ljakarta/servlet/FilterChain;)V

JVMVulnerable params: 0

org/eclipse/jetty/ee8/servlets/PushCacheFilter.doFilter(Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;Ljavax/servlet/FilterChain;)V

JVMVulnerable params: 0

org/eclipse/jetty/ee9/servlets/PushCacheFilter.doFilter(Ljakarta/servlet/ServletRequest;Ljakarta/servlet/ServletResponse;Ljakarta/servlet/FilterChain;)V

JVMVulnerable params: 0

org/eclipse/jetty/servlets/PushCacheFilter.doFilter(Ljakarta/servlet/ServletRequest;Ljakarta/servlet/ServletResponse;Ljakarta/servlet/FilterChain;)V

JVMVulnerable params: 0

org/eclipse/jetty/servlets/PushSessionCacheFilter.doFilter(Ljakarta/servlet/ServletRequest;Ljakarta/servlet/ServletResponse;Ljakarta/servlet/FilterChain;)V

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · PR #10755PROJECT

GitHub · PR #10756PROJECT

GitHub · PR #9715PROJECT

GitHub · PR #9716PROJECT

GitHub · jetty/jetty.projectPROJECT