Vulnerability Note VU#237888
Mortbay Jetty Dump Servlet vulnerable to cross-site scripting
The Mortbay Jetty Dump Servlet contains a cross-site scripting vulnerability.
Mortbay Jetty is a web server that is written in Java. The Dump Servlet that is included with Jetty is vulnerable to cross-site scripting. Note that according to the vendor, the Dump Servlet is for testing purposes and is not intended to be included in a live web site.
A remote, unauthenticated attacker may be able to perform a cross-site scripting attack against a Jetty web server. More information about cross-site scripting can be found in CERT Advisory CA-2000-02.
Apply an update
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Mort Bay||Affected||25 Oct 2007||04 Dec 2007|
CVSS Metrics (Learn More)
Thanks to Tomasz Kuczynski for reporting this vulnerability.
This document was written by Will Dormann.
- CVE IDs: CVE-2007-5613
- Date Public: 05 Nov 2007
- Date First Published: 04 Dec 2007
- Date Last Updated: 03 Dec 2007
- Severity Metric: 3.29
- Document Revision: 7
If you have feedback, comments, or additional information about this vulnerability, please send us email.