Description

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Remediation

References

CVE-2017-9735

Related Vulnerabilities

MySQL CVE-2020-14888 Vulnerability (CVE-2020-14888)

PHP Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2024-4577)

WordPress Plugin Elements kit Elementor addons (Header & Footer Builder, Mega Menu Builder, Layout Library) Multiple Cross-Site Scripting Vulnerabilities (2.1.7)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder CSV Injection (1.12.22)

WordPress Plugin WP Import Export Information Disclosure (3.9.15)

Severity

High

Classification

CVE-2017-9735 CWE-203 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities