Veracode Vulnerability DatabaseVERACODE:7744Cross-Site Scripting (XSS)
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
Mortbay Jetty test web-app is vulnerable to cross-site scripting. The Dump Servlet does not output-sanitise before displaying on a user’s browser. This allows a remote attacker to inject arbitrary Javascript into a victim’s browser to steal session tokens or perform unwanted actions on behalf of the user.
| CPE | Name | Operator | Version |
|---|---|---|---|
| jetty test webapp | le | 6.1.6rc0 | |
| jetty server | le | 6.1.0 |
References
jira.codehaus.org/browse/JETTY-452
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
osvdb.org/42497
secunia.com/advisories/27925
secunia.com/advisories/30941
secunia.com/advisories/35143
svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
www.kb.cert.org/vuls/id/237888
www.securityfocus.com/bid/26697
github.com/jetty-project/codehaus-jetty6/commit/8ceaa876ab9aec8c0fc15f3593071b1e6a1086e7
www.redhat.com/archives/fedora-package-announce/2008-July/msg00227.html
www.redhat.com/archives/fedora-package-announce/2008-July/msg00250.html
Related
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N