GHSA-6jxp-7g74-2rc3 — high GitHub Advisory (CVE-2009-4611) in maven/org.mortbay.jetty:jetty

Description

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-05-02 03:56:13 UTC
Updated: 2023-01-27 05:02:04 UTC
GitHub reviewed: 2022-06-10 22:42:57 UTC
NVD published: 2010-01-13

Score	Percentile
0.95%	75.63%

CVSS Scores

Base score	Version	Severity	Vector
7.3	3.1	—	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.

Identifiers

Type	Value
GHSA	GHSA-6jxp-7g74-2rc3 ↗
CVE	CVE-2009-4611 ↗

CWEs

CWE id	Name
CWE-20	Improper Input Validation

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
maven	org.mortbay.jetty:jetty	>= 6.0.0, < 6.1.23	6.1.23	—
maven	org.mortbay.jetty:jetty	>= 7.0.0, < 7.0.2	7.0.2	—

Improper input validation in Mort Bay Jetty