CVE-2015-2080

HIGH NUCLEI

Fedora < 9.2.9.v20150224 - Information Disclosure

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-2080. PoCs published by LiquidWorm. A Nuclei detection template is also available.

AI-analyzed exploit summary The exploit demonstrates CVE-2015-2080, a Jetty HTTP parser vulnerability in Inductive Automation Ignition 7.8.1, allowing remote unauthenticated attackers to leak arbitrary data from shared buffers via crafted HTTP headers with illegal characters. The provided bash script sends malformed requests to trigger the 'IllegalCharacter' exception, exposing session data.

Description

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textremotemultiple
https://www.exploit-db.com/exploits/39455

The exploit demonstrates CVE-2015-2080, a Jetty HTTP parser vulnerability in Inductive Automation Ignition 7.8.1, allowing remote unauthenticated attackers to leak arbitrary data from shared buffers via crafted HTTP headers with illegal characters. The provided bash script sends malformed requests to trigger the 'IllegalCharacter' exception, exposing session data.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Inductive Automation Ignition 7.8.1 (b2016012216) and 7.8.0 (b2015101414)
No auth needed
Prerequisites: Network access to the target server · Jetty server running on port 8088
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage
HIGHby pikpikcu
Shodan: cpe:"cpe:2.3:o:fedoraproject:fedora"

References (11)

Core 11
Core References
Exploit, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Mar/12
Vendor Advisory mailing-list x_refsource_mlist
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
Vendor Advisory mailing-list x_refsource_mlist
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190307-0005/
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/72768
Third Party Advisory vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031800
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/534755/100/1600/threaded
Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html

Scores

CVSS v3 7.5
EPSS 0.9139
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (9)
eclipse/jetty 9.2.3
eclipse/jetty 9.2.4
eclipse/jetty 9.2.5
eclipse/jetty 9.2.6
eclipse/jetty 9.2.7
eclipse/jetty 9.2.8
eclipse/jetty 9.3.0 m0 (2 CPE variants)
fedoraproject/fedora 22
org.eclipse.jetty/jetty-server 0 - 9.2.9.v20150224Maven
Published Oct 07, 2016
Tracked Since Feb 18, 2026