Description
Gotham Digital Science discovered a critical information leakage vulnerability affecting Jetty sever versions 9.2.3 to 9.2.8. When illegal characters are submitted in header values to the server the exception handling code returns approximately 16 bytes of data from a shared buffer.
Remediation
Upgrade to the latest version of Jetty (this issue was fixed in version 9.2.9.v20150224).
References
Related Vulnerabilities
Joomla! Core 2.5.x Information Disclosure (2.5.0 - 2.5.3)
WordPress Plugin Simple File Downloader Cross-Site Scripting (1.0.4)
Arbitrary file existence disclosure in Action Pack
PostgreSQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-32028)
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9848)