CVE-2009-1523 Directory traversal in Mort Bay Jetty

Medium 5.0 Published 5 May 2009 Updated 7 Aug 2024

Remote attackers can access arbitrary files on the server via directory traversal sequences in the URI of the Jetty HTTP server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-1523?

CVE-2009-1523 is a medium-severity path traversal vulnerability in n/a, published on 5 May 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

Weakness: CWE-22

Which versions are affected by CVE-2009-1523?

4 open source packages ship an affected version, including org.mortbay.jetty:jetty. It affects 1 product.

Package	Affected	Fixed in
`org.mortbay.jetty:jetty` Maven	All versions	`6.1.17`
`org.mortbay.jetty:jetty` Maven	All versions	`6.1.17`
`org.mortbay.jetty:jetty` Maven	From `7.0.0.M0`	`7.0.0.M2`
`org.mortbay.jetty:jetty` Maven	From `7.0.0.M0`	`7.0.0.M2`

Products include Mortbay Jetty.

How do I fix CVE-2009-1523?

Upgrade org.mortbay.jetty:jetty to a fixed version for your release line: 6.1.17 or 7.0.0.M2.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2009-1523 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1523 exists.

Public exploit code: 2 Exploit-DB entries.

Sources

Also known as GHSA-9986-w5h5-vw59.