Description
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Remediation
References
Related Vulnerabilities
WordPress Plugin Convert Plus Unspecified Vulnerability (3.5.6)
Jboss EAP Improper Input Validation Vulnerability (CVE-2020-1732)
Atlassian Jira CVE-2019-20898 Vulnerability (CVE-2019-20898)
WordPress Plugin Google AdSense Click-Fraud Monitoring Cross-Site Scripting (1.8.6)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1488)