CVE-2009-4610: Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers...

Security readout for executives and security teams

CVE-2009-4610 is a cross-site scripting issue in old Mort Bay Jetty releases. If affected diagnostic dump features are reachable, an attacker could cause script or HTML to run in a user's browser through vulnerable request parameters. The source bundle does not show active exploitation. Exposure is likely limited to internet- or intranet-accessible Jetty 6.x or 7.0.0 deployments where the dump features are reachable. The bundle does not state whether these features are enabled by default or identify downstream packaged products. Treat this as a legacy web exposure issue. Prioritize remediation where old Jetty services are public-facing, handle authenticated sessions, or are reachable by privileged users. Urgency is lower without exploitation evidence, but unsupported components increase operational risk. Mitigation focus: Check vendor or project guidance for the fixed Jetty release or recommended configuration.; Remove or restrict access to JSP Dump and Session Dump Servlet features if not required.; Reduce exposure of affected Jetty instances to trusted networks only..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.