High severityNVD Advisory· Published Jan 13, 2010· Updated Apr 23, 2026
CVE-2009-4611
CVE-2009-4611
Description
Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.mortbay.jetty:jettyMaven | >= 6.0.0, < 6.1.23 | 6.1.23 |
org.mortbay.jetty:jettyMaven | >= 7.0.0, < 7.0.2 | 7.0.2 |
Affected products
81cpe:2.3:a:mortbay:jetty:6.0.0:*:*:*:*:*:*:*+ 80 more
- cpe:2.3:a:mortbay:jetty:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta10:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta11:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta12:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta14:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta15:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta16:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta17:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta9:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:betax:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.12:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.12:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.12:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.12:rc4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.12:rc5:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.15:pre0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.15:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.15:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.15:rc4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.15:rc5:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.1:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.20:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:pre0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:pre1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:rc4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.2:rc5:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.4:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.5:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.6:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:7.0.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txtnvdExploitWEB
- www.ush.it/team/ush/hack_httpd_escape/adv.txtnvdExploitWEB
- github.com/advisories/GHSA-6jxp-7g74-2rc3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2009-4611ghsaADVISORY
- fossies.org/linux/jetty-distribution/VERSION.txtghsaWEB
- www.eclipse.org/jetty/about.phpghsaWEB
- www.securityfocus.com/archive/1/508830/100/0/threadednvd
News mentions
0No linked articles in our index yet.