Description
Gotham Digital Science discovered a critical information leakage vulnerability affecting Jetty sever versions 9.2.3 to 9.2.8. When illegal characters are submitted in header values to the server the exception handling code returns approximately 16 bytes of data from a shared buffer.
Remediation
Upgrade to the latest version of Jetty (this issue was fixed in version 9.2.9.v20150224).
References
Related Vulnerabilities
WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-2202)
WordPress Plugin MasterStudy LMS-for Online Courses and Education Information Disclosure (3.2.10)
WordPress Plugin Activity Log Information Disclosure (2.2.12)