CVE Feed

    Dashboard / CVE / CVE-2009-1523

    CVE-2009-1523

    Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

    Published:Apr 28, 2009
    Last Modified:Apr 23, 2026
    EPS:May 5, 2009
    EPSS Score:0.1218
    CVSS Score:5

    Affected Products

    Vendor
    Mortbay
    Product
    Jetty

    Exploits

    https://www.exploit-db.com/exploits/36318https://www.exploit-db.com/exploits/18138

    Related CVEs

    CVE-2009-5049 (CVSS 6.1) — WebApp JSP Snoop page XSS in jetty though 6.1.21.…
    CVE-2009-5048 (CVSS 6.1) — Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.…
    CVE-2011-4461 (CVSS 5.3) — Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigge…
    CVE-2009-4611 (CVSS 7.5) — Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters,…
    CVE-2009-4610 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to …
    CVE-2009-4612 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x throu…
    CVE-2009-4609 (CVSS 5) — The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about…
    CVE-2009-3579 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the CookieDump.java sample application in Mort Bay Jetty 6.1.19 an…
    CVE-2009-1524 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arb…
    CVE-2005-3747 (CVSS 5) — Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, po…

    References

    http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388
    http://jira.codehaus.org/browse/JETTY-1004
    http://secunia.com/advisories/34975
    http://secunia.com/advisories/35143
    http://secunia.com/advisories/35225
    http://secunia.com/advisories/35776
    http://secunia.com/advisories/40553
    http://www.kb.cert.org/vuls/id/402580
    http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
    http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
    http://www.securityfocus.com/bid/34800
    http://www.securityfocus.com/bid/35675
    http://www.securitytracker.com/id?1022563
    http://www.vupen.com/english/advisories/2009/1900
    http://www.vupen.com/english/advisories/2010/1792
    https://bugzilla.redhat.com/show_bug.cgi?id=499867
    https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01257.html
    https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01259.html
    https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01262.html
    http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388
    http://jira.codehaus.org/browse/JETTY-1004
    http://secunia.com/advisories/34975
    http://secunia.com/advisories/35143
    http://secunia.com/advisories/35225
    http://secunia.com/advisories/35776
    http://secunia.com/advisories/40553
    http://www.kb.cert.org/vuls/id/402580
    http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
    http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
    http://www.securityfocus.com/bid/34800
    http://www.securityfocus.com/bid/35675
    http://www.securitytracker.com/id?1022563
    http://www.vupen.com/english/advisories/2009/1900
    http://www.vupen.com/english/advisories/2010/1792
    https://bugzilla.redhat.com/show_bug.cgi?id=499867
    https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01257.html
    https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01259.html
    https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01262.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High