CVE-2009-4611
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Mort Bay Jetty versión 6.x hasta la versión 6.1.22 y 7.0.0 escribe datos backtrace sin sanear los caracteres no imprimibles, lo que podría permitir a los atacantes remotos modificar el título de una ventana, o posiblemente ejecutar comandos arbitrarios o sobrescribir archivos, mediante una solicitud HTTP que contiene un secuencia de escape para un emulador de terminal, relacionado con (1) un valor de cadena en el parámetro Age al URI predeterminado para la Cookie Dump Servle en test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) un valor alfabético en el parámetro A para jsp/expr.jsp, o (3) un valor alfabético en el encabezado HTTP Content-Length para una aplicación arbitraria.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2010-01-13 CVE Reserved
- 2010-01-13 CVE Published
- 2024-02-08 EPSS Updated
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/508830/100/0/threaded | Mailing List |
| URL | Date | SRC |
|---|---|---|
| http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt | 2024-08-07 | |
| http://www.ush.it/team/ush/hack_httpd_escape/adv.txt | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | alpha0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | alpha1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | alpha2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | alpha3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta10 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta11 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta12 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta14 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta15 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta16 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta17 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta4 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta5 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta6 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta7 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta8 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | beta9 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | betax |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | rc1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | rc2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | rc3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.0 Search vendor "Mortbay" for product "Jetty" and version "6.0.0" | rc4 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.1 Search vendor "Mortbay" for product "Jetty" and version "6.0.1" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.0.2 Search vendor "Mortbay" for product "Jetty" and version "6.0.2" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | pre0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | pre1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | pre2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | pre3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | rc1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | rc2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.0 Search vendor "Mortbay" for product "Jetty" and version "6.1.0" | rc3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.1 Search vendor "Mortbay" for product "Jetty" and version "6.1.1" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.1 Search vendor "Mortbay" for product "Jetty" and version "6.1.1" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | pre0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | pre1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | rc1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | rc2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | rc3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | rc4 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.2 Search vendor "Mortbay" for product "Jetty" and version "6.1.2" | rc5 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.3 Search vendor "Mortbay" for product "Jetty" and version "6.1.3" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.4 Search vendor "Mortbay" for product "Jetty" and version "6.1.4" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.4 Search vendor "Mortbay" for product "Jetty" and version "6.1.4" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.4 Search vendor "Mortbay" for product "Jetty" and version "6.1.4" | rc1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.5 Search vendor "Mortbay" for product "Jetty" and version "6.1.5" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.5 Search vendor "Mortbay" for product "Jetty" and version "6.1.5" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.6 Search vendor "Mortbay" for product "Jetty" and version "6.1.6" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.6 Search vendor "Mortbay" for product "Jetty" and version "6.1.6" | rc0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.6 Search vendor "Mortbay" for product "Jetty" and version "6.1.6" | rc1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.7 Search vendor "Mortbay" for product "Jetty" and version "6.1.7" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.8 Search vendor "Mortbay" for product "Jetty" and version "6.1.8" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.9 Search vendor "Mortbay" for product "Jetty" and version "6.1.9" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.10 Search vendor "Mortbay" for product "Jetty" and version "6.1.10" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.11 Search vendor "Mortbay" for product "Jetty" and version "6.1.11" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.12 Search vendor "Mortbay" for product "Jetty" and version "6.1.12" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.12 Search vendor "Mortbay" for product "Jetty" and version "6.1.12" | rc1 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.12 Search vendor "Mortbay" for product "Jetty" and version "6.1.12" | rc2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.12 Search vendor "Mortbay" for product "Jetty" and version "6.1.12" | rc3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.12 Search vendor "Mortbay" for product "Jetty" and version "6.1.12" | rc4 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.12 Search vendor "Mortbay" for product "Jetty" and version "6.1.12" | rc5 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.14 Search vendor "Mortbay" for product "Jetty" and version "6.1.14" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.15 Search vendor "Mortbay" for product "Jetty" and version "6.1.15" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.15 Search vendor "Mortbay" for product "Jetty" and version "6.1.15" | pre0 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.15 Search vendor "Mortbay" for product "Jetty" and version "6.1.15" | rc2 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.15 Search vendor "Mortbay" for product "Jetty" and version "6.1.15" | rc3 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.15 Search vendor "Mortbay" for product "Jetty" and version "6.1.15" | rc4 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.15 Search vendor "Mortbay" for product "Jetty" and version "6.1.15" | rc5 |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.16 Search vendor "Mortbay" for product "Jetty" and version "6.1.16" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.19 Search vendor "Mortbay" for product "Jetty" and version "6.1.19" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 6.1.20 Search vendor "Mortbay" for product "Jetty" and version "6.1.20" | - |
Affected
| ||||||
| Mortbay Search vendor "Mortbay" | Jetty Search vendor "Mortbay" for product "Jetty" | 7.0.0 Search vendor "Mortbay" for product "Jetty" and version "7.0.0" | - |
Affected
| ||||||