PT-2026-114848 · Eclipse Foundation · Eclipse Jetty
CVE-2026-76184
·
Publicado
2026-10-15
·
Atualizado
2026-10-15
CVSS v4.0
8.2
Alta
| Vetor | AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
In Eclipse Jetty, HttpClient may receive a redirect of the form:
/secure/../evil
If an attacker is able to control the redirects, then HttpClient matches authentication credentials against
/secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the Authorization header for /secure to /evil.This also mean that the attacker must have an evil application deployed on the same domain as the target.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Eclipse Jetty