PT-2010-1428 · Mort Bay · Mort Bay Jetty

Published 2010-01-13 · Updated 2011-08-08 · CVE-2009-4609

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mort Bay Jetty versions 6.x through 7.0.0

Description The issue allows remote attackers to obtain sensitive information about internal variables and other data. This is achieved by sending a request to a URI ending in /dump/, which can reveal the value of variables such as getPathTranslated.

Recommendations For Mort Bay Jetty versions 6.x through 7.0.0, consider restricting access to the Dump Servlet to minimize the risk of exploitation. As a temporary workaround, disabling the Dump Servlet functionality until a patch is available can help mitigate the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-4609

Affected Products

Mort Bay Jetty

References · 3

• 🔥 http://ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4609 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4609 · Note