PT-2009-4020 · Mort Bay · Mort Bay Jetty

Greg Wilkins · Publicado 2009-05-05 · Atualizado 2022-05-02 · CVE-2009-1523

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mort Bay Jetty versions 5.1.14, 6.x through 6.1.16, 7.x through 7.0.0.M2

Description: The issue allows remote attackers to access arbitrary files via directory traversal sequences in the URI. This is a result of a directory traversal vulnerability in the HTTP server.

Recommendations: For Mort Bay Jetty version 5.1.14, update to a version later than 5.1.14 to resolve the issue. For Mort Bay Jetty versions 6.x through 6.1.16, update to version 6.1.17 or later. For Mort Bay Jetty versions 7.x through 7.0.0.M2, update to a version later than 7.0.0.M2.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-1523

GHSA-9986-W5H5-VW59

Produtos afetados

Mort Bay Jetty

Referências · 24

• 🔥 https://exploit-db.com/exploits/36318 · Exploit
• 🔥 https://exploit-db.com/exploits/18138 · Exploit
• http://securityfocus.com/bid/34800 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01259.html · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/cpujul2009-091332.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1523 · Nota de Segurança
• http://secunia.com/advisories/35776 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01257.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01262.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9986-w5h5-vw59 · Aviso do Fabricante
• http://securitytracker.com/id?1022563 · Nota
• http://vupen.com/english/advisories/2009/1900 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/402580 · Nota
• http://vupen.com/english/advisories/2010/1792 · Aviso do Fabricante
• http://secunia.com/advisories/34975 · Aviso do Fabricante