Jetty Javascript Inclusion Vulnerability
Date: 2022-04
Affected: maven/org.mortbay.jetty:jetty
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2002-1533
CWE: CWE-80

Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (`%0a`).


Mitigations:

Architectural layers (MAESTRO):