CVE-2016-4800

CRITICAL

Eclipse Jetty 9.3.0-9.3.8 - Improper Access Control via Path Normalization Bypass

Title source: llm
STIX 2.1

Description

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

References (6)

Core 6
Core References
Patch, Vendor Advisory mailing-list x_refsource_mlist
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/90945
Mitigation, Patch, Third Party Advisory x_refsource_misc
http://www.ocert.org/advisories/ocert-2016-001.html
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190307-0006/
Third Party Advisory, VDB Entry x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-16-362

Scores

CVSS v3 9.8
EPSS 0.0061
EPSS Percentile 70.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-284
Status published
Products (10)
eclipse/jetty 9.3.0 (6 CPE variants)
eclipse/jetty 9.3.1
eclipse/jetty 9.3.2
eclipse/jetty 9.3.3
eclipse/jetty 9.3.4 (3 CPE variants)
eclipse/jetty 9.3.5
eclipse/jetty 9.3.6
eclipse/jetty 9.3.7 (3 CPE variants)
eclipse/jetty 9.3.8 (2 CPE variants)
org.eclipse.jetty/jetty-server 9.3.0 - 9.3.9Maven
Published Apr 13, 2017
Tracked Since Feb 18, 2026