CVE-2002-1533

Jetty < 4.1.1 - Cross-Site Scripting via JSP Filename with Encoded Linefeed

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-1533. PoCs published by Skinnay.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Jetty by injecting arbitrary JavaScript code via a malformed URL request. The vulnerability arises from insufficient input sanitization, allowing script execution in the context of the target site.

Description

Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).

Exploits (1)

exploitdb WORKING POC VERIFIED
by Skinnay · textwebappsjsp
https://www.exploit-db.com/exploits/21875

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Jetty by injecting arbitrary JavaScript code via a malformed URL request. The vulnerability arises from insufficient input sanitization, allowing script execution in the context of the target site.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Jetty (version not specified)
No auth needed
Prerequisites: A vulnerable Jetty server · Victim interaction (clicking a malicious link)
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-09/0337.html
Vendor Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/10219.php
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/5821

Scores

EPSS 0.0519
EPSS Percentile 90.2%

Details

Status published
Products (2)
jetty/jetty 4.1.0_rc4
org.mortbay.jetty/jetty 0 - 4.1.1Maven
Published Mar 31, 2003
Tracked Since Feb 18, 2026