CVE-2009-4610: XSS

Published Jan 13, 2010

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.

Affected Software

81 affected components

Mortbay Jetty=6.1.5

Mortbay Jetty=6.1.0

Mortbay Jetty=6.1.12-rc3

Mortbay Jetty=6.0.0-beta14

Mortbay Jetty=6.1.0-pre3

Mortbay Jetty=6.1.0-rc1

Mortbay Jetty=6.1.15-pre0

Mortbay Jetty=6.0.0-beta9

Mortbay Jetty=6.0.0-beta2

Mortbay Jetty=6.0.0-beta15

Mortbay Jetty=6.0.0-alpha0

Mortbay Jetty=6.1.14

Mortbay Jetty=6.1.11

Mortbay Jetty=6.0.0-beta0

Mortbay Jetty=6.1.0-rc0

Mortbay Jetty=6.1.4-rc1

Mortbay Jetty=6.1.15-rc4

Mortbay Jetty=6.0.0-alpha3

Mortbay Jetty=6.0.0-rc3

Mortbay Jetty=6.1.10

Mortbay Jetty=6.0.1

Mortbay Jetty=6.1.15-rc5

Mortbay Jetty=6.0.0-beta3

Mortbay Jetty=6.1.6

Mortbay Jetty=6.1.2-rc4

Mortbay Jetty=6.0.0-alpha1

Mortbay Jetty=6.1.1-rc0

Mortbay Jetty=6.0.0-beta16

Mortbay Jetty=6.1.3

Mortbay Jetty=6.1.2-rc2

Mortbay Jetty=6.0.0-beta10

Mortbay Jetty=6.1.2-rc3

Mortbay Jetty=6.0.0-rc1

Mortbay Jetty=6.1.12-rc2

Mortbay Jetty=6.1.15

Mortbay Jetty=6.0.0-rc0

Mortbay Jetty=6.1.2-rc5

Mortbay Jetty=6.1.1

Mortbay Jetty=6.1.6-rc1

Mortbay Jetty=6.1.0-pre1

Mortbay Jetty=6.1.5-rc0

Mortbay Jetty=6.0.0-beta1

Mortbay Jetty=6.0.0-alpha2

Mortbay Jetty=6.0.0-beta4

Mortbay Jetty=6.1.12-rc5

Mortbay Jetty=6.1.0-pre0

Mortbay Jetty=6.0.0-rc2

Mortbay Jetty=6.0.0

Mortbay Jetty=6.1.2-rc0

Mortbay Jetty=6.1.8

Mortbay Jetty=6.0.0-beta6

Mortbay Jetty=6.1.20

Mortbay Jetty=6.1.12-rc4

Mortbay Jetty=6.1.16

Mortbay Jetty=6.1.2-pre0

Mortbay Jetty=6.0.0-beta17

Mortbay Jetty=6.1.2-pre1

Mortbay Jetty=6.1.4-rc0

Mortbay Jetty=6.0.0-beta8

Mortbay Jetty=6.1.0-rc3

Mortbay Jetty=6.1.0-rc2

Mortbay Jetty=6.1.15-rc3

Mortbay Jetty=6.1.6-rc0

Mortbay Jetty=6.1.0-pre2

Mortbay Jetty=6.1.7

Mortbay Jetty=6.0.0-beta12

Mortbay Jetty=6.1.15-rc2

Mortbay Jetty=6.1.19

Mortbay Jetty=6.0.0-beta7

Mortbay Jetty=6.0.0-beta11

Mortbay Jetty=6.0.0-beta5

Mortbay Jetty=6.0.0-rc4

Mortbay Jetty=6.0.0-betax

Mortbay Jetty=6.1.9

Mortbay Jetty=6.1.12

Mortbay Jetty=6.1.2

Mortbay Jetty=6.0.2

Mortbay Jetty=7.0.0

Mortbay Jetty=6.1.2-rc1

Mortbay Jetty=6.1.12-rc1

Mortbay Jetty=6.1.4

Event History

Jan 13, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4610?

CVE-2009-4610 has a moderate severity level due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2009-4610?

To mitigate CVE-2009-4610, it is recommended to upgrade to a non-vulnerable version of Mort Bay Jetty.

What versions of Jetty are affected by CVE-2009-4610?

CVE-2009-4610 affects Mort Bay Jetty versions 6.x and 7.0.0.

What types of attacks can CVE-2009-4610 enable?

CVE-2009-4610 can enable remote attackers to inject arbitrary web scripts or HTML through cross-site scripting (XSS) vulnerabilities.

Is there a workaround for CVE-2009-4610?

There are no known workarounds for CVE-2009-4610; upgrading is the best course of action.