CVE-2009-4609

Published: Jan 13, 2010Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.

Affected (81)

Products: Mortbay: Jetty

Mortbay

1 product

Jetty

Configuration A

81 vulnerable

Vulnerable Software	Affected Versions
Mortbay Jetty	Version 6.0.0
Mortbay Jetty	Version 6.0.0 alpha0
Mortbay Jetty	Version 6.0.0 alpha1
Mortbay Jetty	Version 6.0.0 alpha2
Mortbay Jetty	Version 6.0.0 alpha3
Mortbay Jetty	Version 6.0.0 beta0
Mortbay Jetty	Version 6.0.0 beta10
Mortbay Jetty	Version 6.0.0 beta11
Mortbay Jetty	Version 6.0.0 beta12
Mortbay Jetty	Version 6.0.0 beta14
Mortbay Jetty	Version 6.0.0 beta15
Mortbay Jetty	Version 6.0.0 beta16
Mortbay Jetty	Version 6.0.0 beta17
Mortbay Jetty	Version 6.0.0 beta1
Mortbay Jetty	Version 6.0.0 beta2
Mortbay Jetty	Version 6.0.0 beta3
Mortbay Jetty	Version 6.0.0 beta4
Mortbay Jetty	Version 6.0.0 beta5
Mortbay Jetty	Version 6.0.0 beta6
Mortbay Jetty	Version 6.0.0 beta7
Mortbay Jetty	Version 6.0.0 beta8
Mortbay Jetty	Version 6.0.0 beta9
Mortbay Jetty	Version 6.0.0 betax
Mortbay Jetty	Version 6.0.0 rc0
Mortbay Jetty	Version 6.0.0 rc1
Mortbay Jetty	Version 6.0.0 rc2
Mortbay Jetty	Version 6.0.0 rc3
Mortbay Jetty	Version 6.0.0 rc4
Mortbay Jetty	Version 6.0.1
Mortbay Jetty	Version 6.0.2
Mortbay Jetty	Version 6.1.0
Mortbay Jetty	Version 6.1.0 pre0
Mortbay Jetty	Version 6.1.0 pre1
Mortbay Jetty	Version 6.1.0 pre2
Mortbay Jetty	Version 6.1.0 pre3
Mortbay Jetty	Version 6.1.0 rc0
Mortbay Jetty	Version 6.1.0 rc1
Mortbay Jetty	Version 6.1.0 rc2
Mortbay Jetty	Version 6.1.0 rc3
Mortbay Jetty	Version 6.1.10
Mortbay Jetty	Version 6.1.11
Mortbay Jetty	Version 6.1.12
Mortbay Jetty	Version 6.1.12 rc1
Mortbay Jetty	Version 6.1.12 rc2
Mortbay Jetty	Version 6.1.12 rc3
Mortbay Jetty	Version 6.1.12 rc4
Mortbay Jetty	Version 6.1.12 rc5
Mortbay Jetty	Version 6.1.14
Mortbay Jetty	Version 6.1.15
Mortbay Jetty	Version 6.1.15 pre0
Mortbay Jetty	Version 6.1.15 rc2
Mortbay Jetty	Version 6.1.15 rc3
Mortbay Jetty	Version 6.1.15 rc4
Mortbay Jetty	Version 6.1.15 rc5
Mortbay Jetty	Version 6.1.16
Mortbay Jetty	Version 6.1.19
Mortbay Jetty	Version 6.1.1
Mortbay Jetty	Version 6.1.1 rc0
Mortbay Jetty	Version 6.1.20
Mortbay Jetty	Version 6.1.2
Mortbay Jetty	Version 6.1.2 pre0
Mortbay Jetty	Version 6.1.2 pre1
Mortbay Jetty	Version 6.1.2 rc0
Mortbay Jetty	Version 6.1.2 rc1
Mortbay Jetty	Version 6.1.2 rc2
Mortbay Jetty	Version 6.1.2 rc3
Mortbay Jetty	Version 6.1.2 rc4
Mortbay Jetty	Version 6.1.2 rc5
Mortbay Jetty	Version 6.1.3
Mortbay Jetty	Version 6.1.4
Mortbay Jetty	Version 6.1.4 rc0
Mortbay Jetty	Version 6.1.4 rc1
Mortbay Jetty	Version 6.1.5
Mortbay Jetty	Version 6.1.5 rc0
Mortbay Jetty	Version 6.1.6
Mortbay Jetty	Version 6.1.6 rc0
Mortbay Jetty	Version 6.1.6 rc1
Mortbay Jetty	Version 6.1.7
Mortbay Jetty	Version 6.1.8
Mortbay Jetty	Version 6.1.9
Mortbay Jetty	Version 7.0.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Source: cve@mitre.org

Exploit

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.