full-disclosure - [FD] Jetty 6.1.6 Cross-Site Scripting (XSS)

Open Source and information security mailing list archives

Message-Id: <20180814170553.B10FB40652@smtp.hushmail.com>
Date: Tue, 14 Aug 2018 10:05:53 -0700
From: 1n3--- via Fulldisclosure <fulldisclosure@...lists.org>
To: fulldisclosure@...lists.org
Subject: [FD] Jetty 6.1.6 Cross-Site Scripting (XSS)

Title: Jetty 6.1.6 Cross-Site Scripting
Date: 8/14/2018
Author: 1N3@...wdShield - https://crowdshield.com
Software Link: http://www.mortbay.org/jetty/
Tested on: Jetty 6.1.6 (other versions may also be vulnerable)
CVE: N/A

Background:  Jetty 6.1.6 is vulnerable to Cross-Site Scripting (XSS)
which allows an  attacker to inject malicious code into the affected
site. 

An  attacker can trigger the exploit by appending the following
payload to  an affected web server which has an open directory listing
enabled (https://victim.com//..;/">").

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives