CVE-2009-4612

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-01-13 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.

Affected products

Mortbay Jetty: 6.1.0, 6.1.0-pre0, 6.1.0-pre1, 6.1.0-pre2, 6.1.0-pre3, 6.1.0-rc0 (+45)

References

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt

Get alerted when CVE-2009-4612 or the next vulnerability affects your stack