medium4.3Public exploit code
CVE-2009-4612
Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Jetty 6.1.x - JSP Snoop Page Multiple Cross-Site Scripting Vulnerabilities2009-10-24 · webapps · jsp · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mortbay | Jetty | Versions 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5 |