GCVE - cpe:2.3:a:mortbay:jetty:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mortbay:jetty:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Mortbay (`65e537d6-e55b-57f2-a298-b13e77c4f48e`)
Product	Jetty (`dd70629b-3849-54ad-8968-4da06363ee77`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:eclipse/jetty`	purl2cpe	2026-06-01 10:15:08.773900
`pkg:github/eclipse/jetty.project`	purl2cpe	2026-06-01 10:15:08.773902
`pkg:maven/org.apache.jetty/jetty`	purl2cpe	2026-06-01 10:15:08.773905

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-5049`	vulnerable	2026-06-08 04:51:51.741669	Details available WebApp JSP Snoop page XSS in jetty though 6.1.21. Published: 2019-11-06T18:46:12.000Z Updated: 2024-08-07T07:24:54.020Z Open on db.gcve.eu Reference links http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt https://security-tracker.debian.org/tracker/CVE-2009-5049 https://www.openwall.com/lists/oss-security/2011/01/14/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-5048`	vulnerable	2026-06-08 04:51:51.741211	Details available Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20. Published: 2019-11-06T18:35:11.000Z Updated: 2024-08-07T07:24:53.986Z Open on db.gcve.eu Reference links http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt https://security-tracker.debian.org/tracker/CVE-2009-5048 https://www.openwall.com/lists/oss-security/2011/01/14/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1524`	vulnerable	2026-06-08 04:51:23.726990	Details available Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character. Published: 2009-05-05T17:00:00.000Z Updated: 2024-08-07T05:13:25.748Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/34800 http://www.vupen.com/english/advisories/2010/1792 http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388 https://bugzilla.redhat.com/show_bug.cgi?id=499867 http://secunia.com/advisories/34975	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1523`	vulnerable	2026-06-08 04:51:23.539064	Details available Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI. Published: 2009-05-05T17:00:00.000Z Updated: 2024-08-07T05:13:25.642Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/34800 http://jira.codehaus.org/browse/JETTY-1004 http://www.vupen.com/english/advisories/2010/1792 http://secunia.com/advisories/35776 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01262.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3747`	vulnerable	2026-06-08 04:48:41.963141	Details available Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758. Published: 2005-11-22T11:00:00.000Z Updated: 2024-08-07T23:24:35.982Z Open on db.gcve.eu Reference links http://sourceforge.net/project/shownotes.php?release_id=372086&group_id=7322 http://www.securityfocus.com/archive/1/450315/100/0/threaded http://www.vupen.com/english/advisories/2005/2515 http://www.securityfocus.com/bid/15515 http://secunia.com/advisories/22669	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Jetty

Notes

PURL mappings

Vulnerability references

Contribute