GitHub Advisoryadvisory · Maven

GHSA-5mq8-h82p-wjf2 Jetty Javascript Inclusion Vulnerability

MEDIUM Published 2022-04-30 Modified 2024-02-12 Official page ↗
Aliases
CVE-2002-1533
Ecosystem
Maven
Packages
org.mortbay.jetty:jetty
Severity
Moderate
Weaknesses
CWE-80
Reviewed
2024-02-12

Affected packages

• Maven org.mortbay.jetty:jetty: < 4.1.1 → fixed in 4.1.1

Description

Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (`%0a`).

Related

Alias · CVE (1)

  • CVE-2002-1533 Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP… vulnerability

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References