GitHub Advisoryadvisory · Maven
GHSA-872g-2h8h-362q Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
CRITICAL
Official page ↗
- Aliases
- CVE-2016-4800
- Ecosystem
- Maven
- Packages
- org.eclipse.jetty:jetty-server
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-284
- Reviewed
- 2020-06-16
Affected packages
• Maven org.eclipse.jetty:jetty-server: >= 9.3.0, < 9.3.9 → fixed in 9.3.9
Description
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Related
Alias · CVE (1)
- CVE-2016-4800 The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass… vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-4800 advisory
- https://github.com/advisories/GHSA-872g-2h8h-362q advisory
- https://security.netapp.com/advisory/ntap-20190307-0006 web
- https://www.oracle.com/security-alerts/cpuoct2020.html web
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html web
- http://www.ocert.org/advisories/ocert-2016-001.html web
- http://www.securityfocus.com/bid/90945 web
- http://www.zerodayinitiative.com/advisories/ZDI-16-362 web