CVE-2009-1523

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 25.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-05 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

Affected products

Mortbay Jetty: through 6.1.16; through 7.0.0; 1.0, 1.0.1, 1.1, 1.1.1, 1.2.0, 1.3.0 (+324)

References

http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388
http://jira.codehaus.org/browse/JETTY-1004
http://secunia.com/advisories/34975
http://secunia.com/advisories/35143
http://secunia.com/advisories/35225
http://secunia.com/advisories/35776
http://secunia.com/advisories/40553
http://www.kb.cert.org/vuls/id/402580
http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
http://www.securityfocus.com/bid/34800
http://www.securityfocus.com/bid/35675

Get alerted when CVE-2009-1523 or the next vulnerability affects your stack