CVE-2009-4610

Published: Jan 13, 2010Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.

Affected (81)

Products: Mortbay: Jetty

Mortbay

1 product

Jetty

Configuration A

81 vulnerable

Vulnerable Software	Affected Versions
Mortbay Jetty	Version 6.0.0
Mortbay Jetty	Version 6.0.0 alpha0
Mortbay Jetty	Version 6.0.0 alpha1
Mortbay Jetty	Version 6.0.0 alpha2
Mortbay Jetty	Version 6.0.0 alpha3
Mortbay Jetty	Version 6.0.0 beta0
Mortbay Jetty	Version 6.0.0 beta10
Mortbay Jetty	Version 6.0.0 beta11
Mortbay Jetty	Version 6.0.0 beta12
Mortbay Jetty	Version 6.0.0 beta14
Mortbay Jetty	Version 6.0.0 beta15
Mortbay Jetty	Version 6.0.0 beta16
Mortbay Jetty	Version 6.0.0 beta17
Mortbay Jetty	Version 6.0.0 beta1
Mortbay Jetty	Version 6.0.0 beta2
Mortbay Jetty	Version 6.0.0 beta3
Mortbay Jetty	Version 6.0.0 beta4
Mortbay Jetty	Version 6.0.0 beta5
Mortbay Jetty	Version 6.0.0 beta6
Mortbay Jetty	Version 6.0.0 beta7
Mortbay Jetty	Version 6.0.0 beta8
Mortbay Jetty	Version 6.0.0 beta9
Mortbay Jetty	Version 6.0.0 betax
Mortbay Jetty	Version 6.0.0 rc0
Mortbay Jetty	Version 6.0.0 rc1
Mortbay Jetty	Version 6.0.0 rc2
Mortbay Jetty	Version 6.0.0 rc3
Mortbay Jetty	Version 6.0.0 rc4
Mortbay Jetty	Version 6.0.1
Mortbay Jetty	Version 6.0.2
Mortbay Jetty	Version 6.1.0
Mortbay Jetty	Version 6.1.0 pre0
Mortbay Jetty	Version 6.1.0 pre1
Mortbay Jetty	Version 6.1.0 pre2
Mortbay Jetty	Version 6.1.0 pre3
Mortbay Jetty	Version 6.1.0 rc0
Mortbay Jetty	Version 6.1.0 rc1
Mortbay Jetty	Version 6.1.0 rc2
Mortbay Jetty	Version 6.1.0 rc3
Mortbay Jetty	Version 6.1.10
Mortbay Jetty	Version 6.1.11
Mortbay Jetty	Version 6.1.12
Mortbay Jetty	Version 6.1.12 rc1
Mortbay Jetty	Version 6.1.12 rc2
Mortbay Jetty	Version 6.1.12 rc3
Mortbay Jetty	Version 6.1.12 rc4
Mortbay Jetty	Version 6.1.12 rc5
Mortbay Jetty	Version 6.1.14
Mortbay Jetty	Version 6.1.15
Mortbay Jetty	Version 6.1.15 pre0
Mortbay Jetty	Version 6.1.15 rc2
Mortbay Jetty	Version 6.1.15 rc3
Mortbay Jetty	Version 6.1.15 rc4
Mortbay Jetty	Version 6.1.15 rc5
Mortbay Jetty	Version 6.1.16
Mortbay Jetty	Version 6.1.19
Mortbay Jetty	Version 6.1.1
Mortbay Jetty	Version 6.1.1 rc0
Mortbay Jetty	Version 6.1.20
Mortbay Jetty	Version 6.1.2
Mortbay Jetty	Version 6.1.2 pre0
Mortbay Jetty	Version 6.1.2 pre1
Mortbay Jetty	Version 6.1.2 rc0
Mortbay Jetty	Version 6.1.2 rc1
Mortbay Jetty	Version 6.1.2 rc2
Mortbay Jetty	Version 6.1.2 rc3
Mortbay Jetty	Version 6.1.2 rc4
Mortbay Jetty	Version 6.1.2 rc5
Mortbay Jetty	Version 6.1.3
Mortbay Jetty	Version 6.1.4
Mortbay Jetty	Version 6.1.4 rc0
Mortbay Jetty	Version 6.1.4 rc1
Mortbay Jetty	Version 6.1.5
Mortbay Jetty	Version 6.1.5 rc0
Mortbay Jetty	Version 6.1.6
Mortbay Jetty	Version 6.1.6 rc0
Mortbay Jetty	Version 6.1.6 rc1
Mortbay Jetty	Version 6.1.7
Mortbay Jetty	Version 6.1.8
Mortbay Jetty	Version 6.1.9
Mortbay Jetty	Version 7.0.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Source: cve@mitre.org

Exploit

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.