PT-2010-1428 · Mort Bay · Mort Bay Jetty

Publicado 2010-01-13 · Atualizado 2011-08-08 · CVE-2009-4609

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mort Bay Jetty versions 6.x through 7.0.0

Description The issue allows remote attackers to obtain sensitive information about internal variables and other data. This is achieved by sending a request to a URI ending in /dump/, which can reveal the value of variables such as getPathTranslated.

Recommendations For Mort Bay Jetty versions 6.x through 7.0.0, consider restricting access to the Dump Servlet to minimize the risk of exploitation. As a temporary workaround, disabling the Dump Servlet functionality until a patch is available can help mitigate the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-4609

Produtos afetados

Mort Bay Jetty

Referências · 3

• 🔥 http://ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4609 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4609 · Nota de Segurança