Core Security Technologies Advisory – Jetty includes several sample web applications for the developer to learn from. One of them sets cookies with user supplied data, and then dumps them as html. This application does not filter the user supplied data when outputting it to the visitor. This constitutes a persistent XSS vulnerability.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/81841/CORE-2009-0922.txt
Source: https://packetstormsecurity.com/files/81841/Core-Security-Technologies-Advisory-2009.0922.html