{"id":"CVE-2009-1523","aliases":["EUVD-2022-3335","GHSA-9986-w5h5-vw59"],"status":"published","title":"Directory traversal in Mort Bay Jetty","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.25802,"percentile":0.97987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2009-05-05T17:00:00Z","modified":"2026-09-10T03:49:32Z","exploits":[{"source":"exploitdb","id":"EDB-18138","title":"VMware - Update Manager Directory Traversal","type":"remote","platform":"windows","date":"2011-11-21","url":"https://www.exploit-db.com/exploits/18138"},{"source":"exploitdb","id":"EDB-36318","title":"Jetty Web Server - Directory Traversal","type":"remote","platform":"windows","date":"2011-11-18","verified":true,"url":"https://www.exploit-db.com/exploits/36318"}],"fixes":[{"ecosystem":"Maven","package":"org.mortbay.jetty:jetty","fixed_in":["6.1.17","7.0.0.M2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mortbay.jetty:jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mortbay.jetty:jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0.M0"},{"fixed":"7.0.0.M2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mortbay.jetty:jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.17"}]}],"versions":["4.1-rc1","4.1-rc6","4.2.10","4.2.12","4.2.2","4.2.3","4.2.9","6.0.0","6.0.0Beta1","6.0.0beta1","6.0.0beta10","6.0.0beta11","6.0.0beta12","6.0.0beta14","6.0.0beta15","6.0.0beta16","6.0.0beta17","6.0.0beta2","6.0.0beta3","6.0.0beta4","6.0.0beta5","6.0.0beta6","6.0.0beta7","6.0.0beta8","6.0.0beta9","6.0.0rc0","6.0.0rc1","6.0.0rc2","6.0.0rc3","6.0.0rc4","6.0.1","6.0.2","6.1.0","6.1.0pre0","6.1.0pre1","6.1.0pre2","6.1.0pre3","6.1.0rc0","6.1.0rc1","6.1.0rc2","6.1.0rc3","6.1.1","6.1.10","6.1.11","6.1.12","6.1.12.rc2","6.1.12.rc3","6.1.12.rc4","6.1.12.rc5","6.1.12rc1","6.1.14","6.1.15","6.1.15.pre0","6.1.15.rc2","6.1.15.rc3","6.1.15.rc4","6.1.15.rc5","6.1.16","6.1.1rc0","6.1.1rc1","6.1.2","6.1.2pre0","6.1.2pre1","6.1.2rc0","6.1.2rc1","6.1.2rc2","6.1.2rc4","6.1.2rc5","6.1.3","6.1.4","6.1.4rc0","6.1.4rc1","6.1.5","6.1.5rc0","6.1.6","6.1.6rc0","6.1.6rc1","6.1.7","6.1.8","6.1.9","6.1H.10","6.1H.14","6.1H.14.1","6.1H.22","6.1H.4-beta","6.1H.4rc1","6.1H.5-beta","6.1H.6","6.1H.7","6.1H.8","test-6.0.0","test-6.0.0rc3","test-6.0.0rc4","test-6.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.mortbay.jetty:jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0.M0"},{"fixed":"7.0.0.M2"}]}]}],"products":[{"vendor":"mortbay","product":"jetty"}],"references":[{"url":"http://www.securityfocus.com/bid/34800","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://jira.codehaus.org/browse/JETTY-1004","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2010/1792","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","web"]},{"url":"http://secunia.com/advisories/35776","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01262.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02282388","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www.securitytracker.com/id?1022563","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2009/1900","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01257.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=499867","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/34975","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/35675","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.kb.cert.org/vuls/id/CRDY-7RKQCY","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/35225","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/35143","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/40553","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/402580","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01259.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1523","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9986-w5h5-vw59"}],"sources":{"cve":[{"id":"CVE-2009-1523","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","status":"published","published":"2009-05-05T17:00:00Z","modified":"2024-08-07T05:13:25.642Z","updated_at":"2026-11-02T14:33:25.126493Z"}],"euvd":[{"id":"EUVD-2022-3335","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","status":"published","published":"2009-05-05T17:00:00Z","modified":"2024-08-07T05:13:25Z","updated_at":"2026-11-03T01:39:21.330306Z"}],"ghsa":[{"id":"GHSA-9986-w5h5-vw59","title":"Directory traversal in Mort Bay Jetty","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","status":"published","published":"2022-05-02T03:26:04Z","modified":"2023-08-03T17:32:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2009-1523","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","status":"published","published":"2009-05-05T17:30:00.327Z","modified":"2026-06-16T23:07:26.793Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:01:35.136779Z"}],"osv":[{"id":"GHSA-9986-w5h5-vw59","title":"Directory traversal in Mort Bay Jetty","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","status":"published","published":"2022-05-02T03:26:04Z","modified":"2026-09-10T03:49:32.38768964Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.524801Z"}]}}