PT-2016-6148 · Eclipse · Eclipse Jetty

Publicado 2016-06-03 · Atualizado 2020-10-20 · CVE-2016-4800

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.3.x through 9.3.8

Description The issue concerns a path normalization mechanism flaw in the PathResource class, allowing remote attackers to bypass security constraints by utilizing URLs with specific escaped characters, notably backslashes, on Windows systems.

Recommendations For Eclipse Jetty versions 9.3.x through 9.3.8, update to version 9.3.9 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-4800

GHSA-872G-2H8H-362Q

ZDI-16-362

Produtos afetados

Eclipse Jetty

Referências · 12

• http://ocert.org/advisories/ocert-2016-001.html · Correção
• https://github.com/advisories/GHSA-872g-2h8h-362q · Nota
• https://osv.dev/vulnerability/CVE-2016-4800 · Aviso do Fabricante
• http://securityfocus.com/bid/90945 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4800 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-16-362 · Nota
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-16-362 · Nota de Segurança
• https://security.netapp.com/advisory/ntap-20190307-0006 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4800 · Nota
• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• https://osv.dev/vulnerability/GHSA-872g-2h8h-362q · Aviso do Fabricante