← Back

CVE-2016-4800

nvd nist
Published: Apr 13, 2017Modified: May 13, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Affected (19)

Products: Eclipse: Jetty
Eclipse
1 product
Jetty
Configuration A
19 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Eclipse
Jetty
Version 9.3.0
Jetty
Version 9.3.0 m0
Jetty
Version 9.3.0 m1
Jetty
Version 9.3.0 maintenance2
Jetty
Version 9.3.0 rc0
Jetty
Version 9.3.0 rc1
Jetty
Version 9.3.1
Jetty
Version 9.3.2
Jetty
Version 9.3.3
Jetty
Version 9.3.4
Jetty
Version 9.3.4 rc0
Jetty
Version 9.3.4 rc1
Jetty
Version 9.3.5
Jetty
Version 9.3.6
Jetty
Version 9.3.7
Jetty
Version 9.3.7 rc0
Jetty
Version 9.3.7 rc1
Jetty
Version 9.3.8
Jetty
Version 9.3.8 rc0
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (12)

Source: cve@mitre.org
PatchVendor Advisory
Source: cve@mitre.org
MitigationPatchThird Party Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.