CVE-2009-1523
Directory traversal in Mort Bay Jetty
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
- Record
CVE-2009-1523- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
- Record
CVE-2009-1523- Updated
- 2026-11-02
EUVDEUVD-2022-3335 No score
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
- Record
EUVD-2022-3335- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9986-w5h5-vw59
Directory traversal in Mort Bay Jetty
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
- Record
GHSA-9986-w5h5-vw59- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-9986-w5h5-vw59
Directory traversal in Mort Bay Jetty
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
- Record
GHSA-9986-w5h5-vw59- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.mortbay.jetty:jettyMaven |
before 6.1.17 | 6.1.17 |
org.mortbay.jetty:jettyMaven |
7.0.0.M0 up to 7.0.0.M2 | 7.0.0.M2 |
org.mortbay.jetty:jettyMaven |
before 6.1.17, plus listed versions 4.1-rc14.1-rc64.2.104.2.124.2.2 Show 45 moreShow less4.2.34.2.96.0.06.0.0Beta16.0.0beta16.0.0beta106.0.0beta116.0.0beta126.0.0beta146.0.0beta156.0.0beta166.0.0beta176.0.0beta26.0.0beta36.0.0beta46.0.0beta56.0.0beta66.0.0beta76.0.0beta86.0.0beta96.0.0rc06.0.0rc16.0.0rc26.0.0rc36.0.0rc46.0.16.0.26.1.06.1.0pre06.1.0pre16.1.0pre26.1.0pre36.1.0rc06.1.0rc16.1.0rc26.1.0rc36.1.16.1.106.1.116.1.126.1.12.rc26.1.12.rc36.1.12.rc46.1.12.rc56.1.12rc1 |
6.1.17 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | VMware - Update Manager Directory Traversal | 2011-11-21 |
| Exploit-DB | Jetty Web Server - Directory Traversal | 2011-11-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1523 is a medium vulnerability (CVSS 5.0) in Mortbay Jetty, published May 5, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.8%, the 97th percentile. Fixed in org.mortbay.jetty:jetty 6.1.17.
References
securityfocus.com/bid/34800
jira.codehaus.org/browse/JETTY-1004
vupen.com/english/advisories/2010/1792
secunia.com/advisories/35776
redhat.com/archives/fedora-package-announce/2009-May/msg01262.html
itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388
Show 15 moreShow less
securitytracker.com/id?1022563
bugzilla.redhat.com/show_bug.cgi?id=499867
oracle.com/technetwork/topics/security/cpujul2009-091332.html
kb.cert.org/vuls/id/CRDY-7RKQCY
nvd.nist.gov/vuln/detail/CVE-2009-1523
github.com/advisories/GHSA-9986-w5h5-vw59
Left out here: 44 versions. The JSON record has them.