Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') #13
Description
<title>DetectiveV</title>
<script src="/assets/jquery.self-bd7ddd393353a8d2480a622e80342adf488fb6006d667e8b42e4c0073393abee.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/jquery_ujs.self-784a997f6726036b1993eb2217c9cb558e1cbb801c6da88105588c56f13b466a.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/affix.self-3555752f8a930795ee9e56751a52e6871104ae85d01b3ab8363da3802a5ecc78.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/alert.self-d8b7bd612b3dcfdefb7b5539b9d5848d66ccbd3e7af8bb8d48bfb3288aaa7be8.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/button.self-e74d33ba39500940a78d6fa4d2d64f6ca7fd86d60a2149641f7fde7ba711d8a1.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/carousel.self-35d204878d906298e55bc24553e11fd89b980fc4ffe5792fe36af8c0da289c54.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/collapse.self-056c40532d9f0f126ec17e839f60c942f573fbd61a086e7f156306e3fc5e8c1f.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/dropdown.self-e56c2ffee4618411d43ecf15c89273f6223847ad756e1cd17545d04afa732ed4.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/modal.self-62463080dba6b9d024ff0a3192da0e76eacbc683194f3395047c6f5cfa0acb59.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/scrollspy.self-52afd90e8ba97d9f08617a13986e8869d6c4a45751c0bff59a6f91241e722aca.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/tab.self-dad0d5c377f9fae26394484535ebb23ccf68afae084f896af6ea4cdf8c9f6ae0.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/transition.self-3b268d4cd8c79e46ded7392885f72f64ffb5b0d49948a12b8cf9779f6163e13a.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/tooltip.self-facdc69246a072acb927ded77ff655f7c27a518b9357fddd45d119fbc8a0ab9f.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap/popover.self-210cff1fb4b72b71a29b5122180cb5937c8145cd13a934dc838280f1d9607a3e.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/bootstrap-sprockets.self-fbfa5ad7d9aa0afe439ec4ff3883acc4cb92b62cb67c40d674320c9aa1d4642d.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/callbacks.self-877aef30ae1b040ab8a3aba4e3e309a11d7f2612f44dde450b5c157aa5f95c05.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/issues.self-877aef30ae1b040ab8a3aba4e3e309a11d7f2612f44dde450b5c157aa5f95c05.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/repos.self-2abc19c26ebbf605174fbef79b9fbc2861869c60e15935e80dffcad48cabad9f.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/scans.self-877aef30ae1b040ab8a3aba4e3e309a11d7f2612f44dde450b5c157aa5f95c05.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/users.self-877aef30ae1b040ab8a3aba4e3e309a11d7f2612f44dde450b5c157aa5f95c05.js?body=1" data-turbolinks-track="true"></script>
<script src="/assets/application.self-70f5e35d22f9627d2c24908534d3cf98bc8f738b39a9023e9d6fc51d7cc1ca3d.js?body=1" data-turbolinks-track="true"></script>
<!-- Top Nav Bar -->
<nav class="navbar navbar-default navbar-fixed-top top-nav">
<div class="container-fluid">
<!-- Brand and toggle get grouped for better mobile display -->
<div class="navbar-header">
<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1" aria-expanded="false">
<span class="sr-only">Toggle navigation</span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<img alt="logo" class="logo navbar-brand" src="/assets/detectiveVlogo-f17554413140186c35c94a83ee8515992f7bff66ca6ba3e6bf13c40639278679.png" /><a class="navbar-brand" href="/">Detective V</a>
</div>
<!-- Collect the nav links, forms, and other content for toggling -->
<div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
<ul class="nav navbar-nav navbar-right">
<li><a href="/users/settings">Signed in as aegrobbel</a></li>
</li>
<li id="signout"><a rel="nofollow" data-method="delete" href="/users/sign_out">Signout</a>
</li>
</ul>
</div><!-- /.navbar-collapse -->
</div><!-- /.container-fluid -->
</nav>
<!-- Side Nav Bar -->
<div class="row side-bar">
<div class="side-menu side-nav">
<nav class="navbar navbar-default" role="navigation">
<!-- Brand and toggle get grouped for better mobile display -->
<div class="navbar-header">
<div class="brand-wrapper">
<!-- Brand -->
<div class="brand-name-wrapper">
<p class="navbar-brand" >Repositories</p>
</div>
<a id="repo-scan-trigger" href="/repos"><i class="glyphicon glyphicon-file"></i></a>
<!-- New Project -->
<a id="repo-add-trigger" href="/repos/new"><i class="glyphicon glyphicon-plus"></i></a>
</div>
</div>
<!-- Repo List -->
<div class="side-menu-container">
<ul class="nav navbar-nav side-nav-list">
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>bodgeit -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>bodgeit -->
</span><a class="nav-repo" href="/repos/5">psiinon/bodgeit</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-5">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-5" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/43">11/04/2016 - 13:47</a></li>
<li><a href="/scans/41">11/04/2016 - 12:51</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>detective-v -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>detective-v -->
</span><a class="nav-repo" href="/repos/6">mdp-groupon/detective-v</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-6">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-6" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/42">11/04/2016 - 13:15</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>springcloudsample -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>springcloudsample -->
</span><a class="nav-repo" href="/repos/7">bdf/springcloudsample</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-7">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-7" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/44">11/09/2016 - 12:04</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>d3 -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>d3 -->
</span><a class="nav-repo" href="/repos/8">d3/d3</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-8">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-8" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/45">11/09/2016 - 12:11</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>kraken-js -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>kraken-js -->
</span><a class="nav-repo" href="/repos/9">krakenjs/kraken-js</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-9">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-9" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/46">11/09/2016 - 12:39</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>testme_ng -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>testme_ng -->
</span><a class="nav-repo" href="/repos/10">sshepard/testme_ng</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-10">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-10" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/47">11/09/2016 - 12:47</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>nodejs-sample-app -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>nodejs-sample-app -->
</span><a class="nav-repo" href="/repos/11">ijason/nodejs-sample-app</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-11">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-11" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
<li><a href="/scans/48">11/09/2016 - 12:49</a></li>
</ul>
</div>
</div>
</li>
<li class="panel panel-default" id="dropdown">
<!-- <span class="glyphicon glyphicon-sunglasses"></span>screen -->
<div>
<!-- <span class="glyphicon glyphicon-sunglasses"></span>screen -->
</span><a class="nav-repo" href="/repos/12">zhangyd/screen</a>
<span class="side-nav-arrow" data-toggle="collapse" href="#dropdown-12">
Scans<span class="caret"></span>
</span>
</div>
<!-- Dropdown level 1 -->
<div id="dropdown-12" class="panel-collapse collapse">
<div class="panel-body">
<ul class="nav navbar-nav">
</ul>
</div>
</div>
</li>
</ul>
</div><!-- /.navbar-collapse -->
</nav>
</div>
</div>
<!-- Main content -->
<div class="body side-body">
Detective-V identified the following vulnerability in bodgeit:
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: 4
Details:
, http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
Scanner: OWASP Dependency Check
File: [http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt]
</div>