CVE-2009-4612: XSS

Published Jan 13, 2010

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATHINFO to (4) snoop.jsp.

Affected Software

51 affected components

Mortbay Jetty=6.1.0

Mortbay Jetty=6.1.0-pre0

Mortbay Jetty=6.1.0-pre1

Mortbay Jetty=6.1.0-pre2

Mortbay Jetty=6.1.0-pre3

Mortbay Jetty=6.1.0-rc0

Mortbay Jetty=6.1.0-rc1

Mortbay Jetty=6.1.0-rc2

Mortbay Jetty=6.1.0-rc3

Mortbay Jetty=6.1.1

Mortbay Jetty=6.1.1-rc0

Mortbay Jetty=6.1.2

Mortbay Jetty=6.1.2-pre0

Mortbay Jetty=6.1.2-pre1

Mortbay Jetty=6.1.2-rc0

Mortbay Jetty=6.1.2-rc1

Mortbay Jetty=6.1.2-rc2

Mortbay Jetty=6.1.2-rc3

Mortbay Jetty=6.1.2-rc4

Mortbay Jetty=6.1.2-rc5

Mortbay Jetty=6.1.3

Mortbay Jetty=6.1.4

Mortbay Jetty=6.1.4-rc0

Mortbay Jetty=6.1.4-rc1

Mortbay Jetty=6.1.5

Mortbay Jetty=6.1.5-rc0

Mortbay Jetty=6.1.6

Mortbay Jetty=6.1.6-rc0

Mortbay Jetty=6.1.6-rc1

Mortbay Jetty=6.1.7

Mortbay Jetty=6.1.8

Mortbay Jetty=6.1.9

Mortbay Jetty=6.1.10

Mortbay Jetty=6.1.11

Mortbay Jetty=6.1.12

Mortbay Jetty=6.1.12-rc1

Mortbay Jetty=6.1.12-rc2

Mortbay Jetty=6.1.12-rc3

Mortbay Jetty=6.1.12-rc4

Mortbay Jetty=6.1.12-rc5

Mortbay Jetty=6.1.14

Mortbay Jetty=6.1.15

Mortbay Jetty=6.1.15-pre0

Mortbay Jetty=6.1.15-rc2

Mortbay Jetty=6.1.15-rc3

Mortbay Jetty=6.1.15-rc4

Mortbay Jetty=6.1.15-rc5

Mortbay Jetty=6.1.16

Mortbay Jetty=6.1.19

Mortbay Jetty=6.1.20

Mortbay Jetty=6.1.21

Event History

Jan 13, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4612?

CVE-2009-4612 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2009-4612?

To mitigate CVE-2009-4612, upgrade to a patched version of Mort Bay Jetty that resolves the XSS vulnerabilities.

Which versions of Mort Bay Jetty are affected by CVE-2009-4612?

CVE-2009-4612 affects Mort Bay Jetty versions from 6.1.0 to 6.1.21.

What types of attacks can be executed due to CVE-2009-4612?

CVE-2009-4612 allows remote attackers to execute arbitrary HTML or web scripts via cross-site scripting.

Is CVE-2009-4612 a client-side or server-side vulnerability?

CVE-2009-4612 is considered a server-side vulnerability as it affects the web application server handling requests.