[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] Jetty 6.1.6 Cross-Site Scripting (XSS)
- To: fulldisclosure@xxxxxxxxxxxx
- Subject: [FD] Jetty 6.1.6 Cross-Site Scripting (XSS)
- From: 1n3--- via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>
- Date: Tue, 14 Aug 2018 10:05:53 -0700
Title: Jetty 6.1.6 Cross-Site Scripting
Date: 8/14/2018
Author: 1N3@CrowdShield - https://crowdshield.com
Software Link: http://www.mortbay.org/jetty/
Tested on: Jetty 6.1.6 (other versions may also be vulnerable)
CVE: N/A
Background: Jetty 6.1.6 is vulnerable to Cross-Site Scripting (XSS)
which allows an attacker to inject malicious code into the affected
site.
An attacker can trigger the exploit by appending the following
payload to an affected web server which has an open directory listing
enabled (https://victim.com//..;/";>").
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/