CVE-2009-3579 Cross-site scripting in n/a

What is CVE-2009-3579?

CVE-2009-3579 is a medium-severity cross-site scripting vulnerability in n/a, published on 7 Oct 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in the CookieDump.java sample application in Mort Bay Jetty 6.1.19 and 6.1.20 allows remote attackers to inject arbitrary web script or HTML via the Value parameter in a GET request to cookie/.

Weakness: CWE-79

Which versions are affected by CVE-2009-3579?

It affects 1 product.

Products include Mortbay Jetty.

How do I fix CVE-2009-3579?

No fix has been published for CVE-2009-3579 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2009-3579 being exploited?

There is no known exploitation of CVE-2009-3579 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2009-4611 Improper input validation in Mort Bay Jetty High 7.5
• CVE-2009-5048 Cross-site scripting in n/a Medium 6.1
• CVE-2011-4461 Improper Input Validation in Jetty Medium 5.3
• CVE-2009-4609 Information disclosure in n/a Medium 5.0
• CVE-2009-1523 Directory traversal in Mort Bay Jetty Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hw4x-hf25-fgp2.