CVE-2009-1523: Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x t...

Security readout for executives and security teams

CVE-2009-1523 is a directory traversal flaw in the Mort Bay Jetty HTTP server. A remote attacker could request paths that escape the intended web directory and read arbitrary files accessible to the Jetty process. Business impact depends on whether affected Jetty versions are exposed and what sensitive files that process can read. Exposure is most likely where legacy Jetty HTTP server versions are directly internet-facing or embedded inside older applications, appliances, or distribution packages. Internal-only services still matter if they can read configuration files, credentials, or application secrets. Prioritize remediation for internet-facing or sensitive internal Jetty deployments. Although active exploitation is not established in the provided sources, remote arbitrary file read can expose credentials or confidential data, especially in older unsupported environments. Mitigation focus: Inventory applications and products using Mort Bay Jetty.; Upgrade Jetty 6.x deployments to 6.1.17 or later.; Check vendor guidance for fixed 5.x and 7.x paths..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.