Information disclosure in Mortbay Jetty

CVE-2009-4609

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.

Vulnerability class: Information Disclosure

EPSS: 0.018 (76.1th percentile) — read the EPSS interpretation.

Affected products

  • Mortbay Jetty — versions 6.0.0, 6.0.1, 6.0.2
  • N/a — versions n/a

Weakness classification (CWE)

References