CVE-2009-4611
CVE-2009-4611 is a high-severity vulnerability in Mortbay Jetty with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 3% (87th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-20
- Affected product: Mortbay Jetty
- Published:
- Last modified:
Description
Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Frequently asked questions
- What is CVE-2009-4611?
- Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
- How severe is CVE-2009-4611?
- CVE-2009-4611 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2009-4611 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-4611?
- CVE-2009-4611 primarily affects Mortbay Jetty. In total, 81 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-4611?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2009-4611 published?
- CVE-2009-4611 was published on 2010-01-13 and last updated on 2026-06-16.
References
- http://www.securityfocus.com/archive/1/508830/100/0/threaded
- http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
- http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
Affected products (81)
- cpe:2.3:a:mortbay:jetty:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta10:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta11:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta12:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta14:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta15:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta16:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta17:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:beta9:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:betax:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:pre3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:mortbay:jetty:6.1.1:*:*:*:*:*:*:*
More vulnerabilities in Mortbay Jetty
- CVE-2009-5049 — Medium (CVSS 6.1): WebApp JSP Snoop page XSS in jetty though 6.1.21.
- CVE-2009-5048 — Medium (CVSS 6.1): Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
- CVE-2011-4461 — Medium (CVSS 5.3): Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash…
- CVE-2009-4609 — Medium (CVSS 5.0): The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal…
- CVE-2009-1523 — Medium (CVSS 5.0): Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through…
- CVE-2005-3747 — Medium (CVSS 5.0): Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly…
All CVEs affecting Mortbay Jetty →
Other CWE-20 (Improper Input Validation) vulnerabilities
- CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
- CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
- CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…
Browse all CWE-20 (Improper Input Validation) vulnerabilities →