CVE-2005-3747

Mortbay Jetty Discloses JSP Source Code

5.0 MediumPublic exploitFix available

Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758.

Exploit likelihood

4.39%Up 3.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2005-3747
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-3747
Updated: 2026-11-02

EUVDEUVD-2022-3652 No score

Record: EUVD-2022-3652
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cwq3-qp8v-w8q3 No score

Mortbay Jetty Discloses JSP Source Code

Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash (%5C) characters. NOTE: this might be the same issue as CVE-2006-2758.

Record: GHSA-cwq3-qp8v-w8q3
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-cwq3-qp8v-w8q3 No score

Mortbay Jetty Discloses JSP Source Code

Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash (%5C) characters. NOTE: this might be the same issue as CVE-2006-2758.

Record: GHSA-cwq3-qp8v-w8q3
Weakness: CWE-200
Updated: 2026-11-02

Affected products

mortbay jetty

Affected packages

Affected packages
Package	Affected	Fixed
`org.mortbay.jetty:jetty` Maven	before 5.1.6	5.1.6
`org.mortbay.jetty:jetty` Maven	before 5.1.6, plus listed versions 4.1-rc14.1-rc64.2.104.2.124.2.2 Show 6 moreShow less 4.2.34.2.9test-6.0.0test-6.0.0rc3test-6.0.0rc4test-6.0.1	5.1.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	promise webpam 2.2.0.13 - Multiple Vulnerabilities	2012-03-07

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-3747 is a medium vulnerability (CVSS 5.0) in Mortbay Jetty, published November 22, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.39%, the 91st percentile. Fixed in org.mortbay.jetty:jetty 5.1.6.