CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.36% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- eclipse/jetty
- Source
- cve@mitre.org
References
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.htmlPatch, Vendor Advisory
- http://www.ocert.org/advisories/ocert-2016-001.htmlMitigation, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/90945Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-362Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20190307-0006/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.htmlPatch, Vendor Advisory
- http://www.ocert.org/advisories/ocert-2016-001.htmlMitigation, Patch, Third Party Advisory
- http://www.securityfocus.com/bid/90945Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-362Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20190307-0006/
- https://www.oracle.com/security-alerts/cpuoct2020.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.