PT-2009-4020 · Mort Bay · Mort Bay Jetty

Greg Wilkins · Published 2009-05-05 · Updated 2022-05-02 · CVE-2009-1523

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mort Bay Jetty versions 5.1.14, 6.x through 6.1.16, 7.x through 7.0.0.M2

Description: The issue allows remote attackers to access arbitrary files via directory traversal sequences in the URI. This is a result of a directory traversal vulnerability in the HTTP server.

Recommendations: For Mort Bay Jetty version 5.1.14, update to a version later than 5.1.14 to resolve the issue. For Mort Bay Jetty versions 6.x through 6.1.16, update to version 6.1.17 or later. For Mort Bay Jetty versions 7.x through 7.0.0.M2, update to a version later than 7.0.0.M2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-1523

GHSA-9986-W5H5-VW59

Affected Products

Mort Bay Jetty

References · 24

• 🔥 https://exploit-db.com/exploits/36318 · Exploit
• 🔥 https://exploit-db.com/exploits/18138 · Exploit
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01259.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1523 · Security Note
• http://secunia.com/advisories/35776 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01257.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01262.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9986-w5h5-vw59 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1900 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1792 · Vendor Advisory
• http://secunia.com/advisories/34975 · Vendor Advisory
• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388 · Vendor Advisory
• http://secunia.com/advisories/40553 · Vendor Advisory
• http://secunia.com/advisories/35143 · Vendor Advisory
• http://secunia.com/advisories/35225 · Vendor Advisory