CVE-2009-4612

Published: Jan 13, 2010Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.

Affected (51)

Products: Mortbay: Jetty

Mortbay

1 product

Jetty

Configuration A

51 vulnerable

Vulnerable Software	Affected Versions
Mortbay Jetty	Version 6.1.0
Mortbay Jetty	Version 6.1.0 pre0
Mortbay Jetty	Version 6.1.0 pre1
Mortbay Jetty	Version 6.1.0 pre2
Mortbay Jetty	Version 6.1.0 pre3
Mortbay Jetty	Version 6.1.0 rc0
Mortbay Jetty	Version 6.1.0 rc1
Mortbay Jetty	Version 6.1.0 rc2
Mortbay Jetty	Version 6.1.0 rc3
Mortbay Jetty	Version 6.1.10
Mortbay Jetty	Version 6.1.11
Mortbay Jetty	Version 6.1.12
Mortbay Jetty	Version 6.1.12 rc1
Mortbay Jetty	Version 6.1.12 rc2
Mortbay Jetty	Version 6.1.12 rc3
Mortbay Jetty	Version 6.1.12 rc4
Mortbay Jetty	Version 6.1.12 rc5
Mortbay Jetty	Version 6.1.14
Mortbay Jetty	Version 6.1.15
Mortbay Jetty	Version 6.1.15 pre0
Mortbay Jetty	Version 6.1.15 rc2
Mortbay Jetty	Version 6.1.15 rc3
Mortbay Jetty	Version 6.1.15 rc4
Mortbay Jetty	Version 6.1.15 rc5
Mortbay Jetty	Version 6.1.16
Mortbay Jetty	Version 6.1.19
Mortbay Jetty	Version 6.1.1
Mortbay Jetty	Version 6.1.1 rc0
Mortbay Jetty	Version 6.1.20
Mortbay Jetty	Version 6.1.21
Mortbay Jetty	Version 6.1.2
Mortbay Jetty	Version 6.1.2 pre0
Mortbay Jetty	Version 6.1.2 pre1
Mortbay Jetty	Version 6.1.2 rc0
Mortbay Jetty	Version 6.1.2 rc1
Mortbay Jetty	Version 6.1.2 rc2
Mortbay Jetty	Version 6.1.2 rc3
Mortbay Jetty	Version 6.1.2 rc4
Mortbay Jetty	Version 6.1.2 rc5
Mortbay Jetty	Version 6.1.3
Mortbay Jetty	Version 6.1.4
Mortbay Jetty	Version 6.1.4 rc0
Mortbay Jetty	Version 6.1.4 rc1
Mortbay Jetty	Version 6.1.5
Mortbay Jetty	Version 6.1.5 rc0
Mortbay Jetty	Version 6.1.6
Mortbay Jetty	Version 6.1.6 rc0
Mortbay Jetty	Version 6.1.6 rc1
Mortbay Jetty	Version 6.1.7
Mortbay Jetty	Version 6.1.8
Mortbay Jetty	Version 6.1.9

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Source: cve@mitre.org

Exploit

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.