CVE-2009-4612 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/ (2) jspsnoop/ERROR/ and (3) jspsnoop/IOException/ and possibly the PATH_INFO to (4) snoop.jsp.

Reference

http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt