Home

CVE-2017-9735

Description

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.844

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2017-9735 are fixed in Eclipse-jetty-server 9.4.6Windows
Vulnerabilities CVE-2017-9735 are fixed in Eclipse-jetty-server 9.3.20Windows
Vulnerabilities CVE-2017-9735 are fixed in Eclipse-jetty-server 9.2.22Windows
Multiple Vulnerabilities are affected in IBM Security Verify Directory Integrator 10.0.0Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.0Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1Windows
Vulnerabilities CVE-2017-9735 are fixed in Eclipse-jetty-server for Linux 9.4.6Linux
Vulnerabilities CVE-2017-9735 are fixed in Eclipse-jetty-server for Linux 9.3.20Linux
Vulnerabilities CVE-2017-9735 are fixed in Eclipse-jetty-server for Linux 9.2.22Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234