CVE-2009-1523
At a glance
- Source
- NVD
- EPSS
- EPSS 25.80 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
- http://www.securityfocus.com/bid/34800
- http://jira.codehaus.org/browse/JETTY-1004
- http://www.vupen.com/english/advisories/2010/1792
- http://secunia.com/advisories/35776
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01262.html
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388
- http://www.securitytracker.com/id?1022563
- http://www.vupen.com/english/advisories/2009/1900
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01257.html
- https://bugzilla.redhat.com/show_bug.cgi?id=499867
- http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
- http://secunia.com/advisories/34975
- http://www.securityfocus.com/bid/35675
- http://www.kb.cert.org/vuls/id/CRDY-7RKQCY
- http://secunia.com/advisories/35225
- http://secunia.com/advisories/35143
- http://secunia.com/advisories/40553
- http://www.kb.cert.org/vuls/id/402580
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01259.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-9986-w5h5-vw59 — Directory traversal in Mort Bay Jetty
European references
- ENISA EUVD · EUVD-2022-3335
- GCVE · GCVE-0-2009-1523
CERT-FR advisories
- CERTA-2010-AVI-326 — Vulnérabilités dans VMware vCenter Update Manager · cert.ssi.gouv.fr
- CERTA-2010-AVI-317 — Multiples vulnérabilités dans HP Insight · cert.ssi.gouv.fr
- CERTA-2009-AVI-279 — Multiples vulnérabilités dans des produits Oracle · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mortbay:jetty:*:*:*:*:*:*:*:*≤ 6.1.16cpe:2.3:a:mortbay:jetty:*:m2:*:*:*:*:*:*≤ 7.0.0cpe:2.3:a:mortbay:jetty:1.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.0.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.1.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.2.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.2:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.3:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.4:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.5:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:alpha1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:alpha2:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:beta1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:beta2:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.7:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.b0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.b1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:alpha0:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:alpha1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta0:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta2:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta3:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta4:*:*:*:*:*:*- +292 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |