{"id":"CVE-2002-1533","description":"Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).","cvssScore":5.8,"cvssVersion":"2.0","cvssVector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","cvssMetrics":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-80"],"resolved":"MITIGATION-CANDIDATE","published":"2003-03-31","lastModified":"2026-06-16","affectedProducts":[{"vendor":"jetty","product":"jetty","version":"4.1.0_rc4"}],"totalAffectedProducts":1,"references":[{"url":"https://web.archive.org/web/20040705203137/http://xforce.iss.net/xforce/xfdb/10219","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20041213153950/http://archives.neohapsis.com/archives/bugtraq/2002-09/0337.html","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20061020173202/http://www.securityfocus.com/bid/5821","source":"osv","tags":["WEB"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2002-09/0337.html","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://www.iss.net/security_center/static/10219.php","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/5821","source":"cve@mitre.org","tags":["Exploit","Vendor Advisory"]}],"reasoning":{"decidingSource":"open-source-maven","decidingReason":"This CVE affects an open-source Java library published on Maven Central (Maven packages: org.mortbay.jetty:jetty), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.mortbay.jetty:jetty"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"Open-source Maven artifact indexed by OSV (Maven packages: org.mortbay.jetty:jetty). The source is public, which makes an ARMR patch rule a candidate; nothing here establishes that one can be written.","decisive":true},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"no-match"},{"rule":"below-action-threshold","stage":"disposition","outcome":"withheld","detail":"Has 1 known POC(s) clearing the evidence bar — requires review despite MEDIUM severity"},{"rule":"no-exploit-published","stage":"disposition","outcome":"no-match","detail":"A KEV listing, a CISA verdict of active exploitation, or a reviewed exploit catalogue carries this CVE — somebody has published a working exploit, so it stays a candidate"}],"affectedProducts":[{"vendor":"jetty","product":"jetty","isKnown":false,"cpe":"cpe:2.3:a:jetty:jetty:4.1.0_rc4:*:*:*:*:*:*:*"}],"affectedPackages":[{"name":"org.mortbay.jetty:jetty","introduced":"0","fixed":"4.1.1"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"unverified","type":"patch-rule"},"review":{"state":"automated","basis":"inferred"}},"exploits":[{"source":"exploit-db","url":"https://www.exploit-db.com/exploits/21875","title":"Jetty 4.1 Servlet Engine - Cross-Site Scripting","date":"2002-09-28"}],"signals":{"hasPOC":true,"pocCount":1,"pocSources":["exploit-db"],"firstPOCDate":"2002-09-28"},"kev":{"inKEV":false},"epss":{"available":true,"score":0.02407,"percentile":0.83175},"ssvc":{"available":false}}