<!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="36"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#37">By Date</a>
<a href="38"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="43"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#37">By Thread</a>
<a href="44"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>
</div>
<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">Re: Jetty 6.1.6 Cross-Site Scripting (XSS)</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->
<em>From</em>: 1n3--- via Fulldisclosure <fulldisclosure () seclists org>
<em>Date</em>: Thu, 23 Aug 2018 08:22:48 -0700
<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">It's likely CVE-2009-1524, but the description is vague and no public
PoC was released as far as I can tell.
On 8/23/2018 at 2:00 AM, "Simon Waters" wrote:
On Tue, 21 Aug 2018 at 18:15, 1n3--- via Fulldisclosure wrote:
Title: Jetty 6.1.6 Cross-Site Scripting
Date: 8/14/2018
Author: 1N3@CrowdShield - <a rel="nofollow" href="https://crowdshield.com">https://crowdshield.com</a>
Software Link: <a rel="nofollow" href="http://www.mortbay.org/jetty/">http://www.mortbay.org/jetty/</a>
Tested on: Jetty 6.1.6 (other versions may also be vulnerable)
CVE: N/A
Background: Jetty 6.1.6 is vulnerable to Cross-Site Scripting (XSS)
which allows an attacker to inject malicious code into the affected
site.
An attacker can trigger the exploit by appending the following
payload to an affected web server which has an open directory
listing
enabled (<a rel="nofollow" href="https://victim.com//..;/"">https://victim.com//..;/"</a>;>").
Is this CVE-2009-1524? If so fixed in 6.1.17, April 2009.
_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives & RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a>
</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="36"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#37">By Date</a>
<a href="38"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="43"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#37">By Thread</a>
<a href="44"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><a name="15" href="15">Jetty 6.1.6 Cross-Site Scripting (XSS)</a> <em>1n3--- via Fulldisclosure (Aug 21)</em>
<ul>
<li><a name="43" href="43">Re: Jetty 6.1.6 Cross-Site Scripting (XSS)</a> <em>Simon Waters (Aug 24)</em>
<ul>
<li><strong>Re: Jetty 6.1.6 Cross-Site Scripting (XSS)</strong> <em>1n3--- via Fulldisclosure (Aug 24)</em>
<ul>
<li><a name="44" href="44">Re: Jetty 6.1.6 Cross-Site Scripting (XSS)</a> <em>Simon Waters (Aug 24)</em>
</li><li><a name="38" href="38">Re: Jetty 6.1.6 Cross-Site Scripting (XSS)</a> <em>1n3--- via Fulldisclosure (Aug 24)</em>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>