CVE-2016-4800 in Jetty

Sumário

de MITRE

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Reservar: 13/05/2016
• Divulgação: 13/04/2017
• Moderação: aceite
• Entrada: VDB-99824
• CPE: pronto
• CWE: CWE-284 (confirmado)
• CVSS: 9.8 (NVD)
• EPSS: 0.06363
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-4800
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-4800
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-4800/