PT-2016-6148 · Eclipse · Eclipse Jetty

Published 2016-06-03 · Updated 2020-10-20 · CVE-2016-4800

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.3.x through 9.3.8

Description The issue concerns a path normalization mechanism flaw in the PathResource class, allowing remote attackers to bypass security constraints by utilizing URLs with specific escaped characters, notably backslashes, on Windows systems.

Recommendations For Eclipse Jetty versions 9.3.x through 9.3.8, update to version 9.3.9 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-4800

GHSA-872G-2H8H-362Q

ZDI-16-362

Affected Products

Eclipse Jetty

References · 12

• http://ocert.org/advisories/ocert-2016-001.html · Patch
• https://osv.dev/vulnerability/CVE-2016-4800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4800 · Security Note
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-16-362 · Security Note
• https://osv.dev/vulnerability/GHSA-872g-2h8h-362q · Vendor Advisory
• https://github.com/advisories/GHSA-872g-2h8h-362q · Note
• http://securityfocus.com/bid/90945 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-362 · Note
• https://security.netapp.com/advisory/ntap-20190307-0006 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4800 · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note