Mortbay Jetty vulnerable to Cross-site scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2007-5613 · ADVISORY
• redhat.com/archives/fedora-package-announce/2008-July/msg00227.html · WEB
• redhat.com/archives/fedora-package-announce/2008-July/msg00250.html · WEB
• lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · WEB
• kb.cert.org/vuls/id/237888 · WEB
• jira.codehaus.org/browse/JETTY-452 · Patch
• osvdb.org/42497
• secunia.com/advisories/27925
• secunia.com/advisories/30941
• secunia.com/advisories/35143
• svn.codehaus.org/jetty/jetty/trunk/VERSION.txt
• securityfocus.com/bid/26697

org.mortbay.jetty:jetty のその他の脆弱性

• CVE-2009-4611高 7.5Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote atta…
• CVE-2009-1523中 5.0Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote att…
• CVE-2007-6672中 5.0Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) …
• CVE-2007-5615中 5.0CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP resp…
• CVE-2007-5614高 7.5Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to…