CVE-2002-1533 Jetty Javascript Inclusion Vulnerability
MediumCVSS 5.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jetty | = 4.1.0_rc4 | No fix listed |
| org.mortbay.jetty/jetty(Maven) | < 4.1.1 | 4.1.1 |
| org.mortbay.jetty/jetty(Maven) | = 4.1-rc1 | No fix listed |
| org.mortbay.jetty/jetty(Maven) | = 4.1-rc6 | No fix listed |
| org.mortbay.jetty/jetty(Maven) | = test-6.0.0 | No fix listed |
| org.mortbay.jetty/jetty(Maven) | = test-6.0.0rc3 | No fix listed |
| org.mortbay.jetty/jetty(Maven) | = test-6.0.0rc4 | No fix listed |
| org.mortbay.jetty/jetty(Maven) | = test-6.0.1 | No fix listed |
References
- 20020928 Jetty jsp/servlet engine xss / uname disclosure vuln exploit mailing-list
- jetty-http-xss(10219) vdb-entry vendor-advisory
- 5821 exploit vdb-entry vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- web.archive.org
- web.archive.org
- web.archive.org
- github.com