3

I am running nmap on an http server, and I got the netty version used by the server. Netty version used is 9.4.53.v20231009 , I tried to check online for CVEs related to this version, and it seems this versions is not directly linked to CVEs (reference: https://security.snyk.io/package/maven/org.eclipse.jetty:jetty-server/9.4.53.v20231009).

When checking on mvn, it says there are CVEs coming from transitive dependencies, so my questions can this CVEs be exploitable? should I try to exploit this http server exposed using the transitive CVEs?

Transitive CVEs:

  • CVE-2024-26308
  • CVE-2024-25710
  • CVE-2023-2976
  • CVE-2020-8908

Reference: https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-distribution/9.4.53.v20231009

Improve this question
1
  • 1
    They may or they may not. It depends on the functionality of the library and the dependencies. If you have a CVE on an JSON parser that it's used by the REST body parser of a MVC framework, you can obviously target that.
    – Margaret Bloom
    Commented Sep 10 at 13:02

1 Answer 1

Reset to default
1

Potentially, yes. But there are a number of reasons why they might not be. For example:

  • The transitive dependency might not be deployed; maybe it was a test or build time dependency, or possibly the dependency was removed or replaced at deploy time
  • The dependency might not be used, or not used in a way that exposes a vulnerability

In general though, the fact that the server tells you what it’s running, and the fact that it’s running a version with CVEs in it’s dependencies, raises questions about it’s security.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .