Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-4800US | critical9.8 | — | ||
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other se… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.htmlWEB
- http://www.ocert.org/advisories/ocert-2016-001.htmlWEB
- http://www.securityfocus.com/bid/90945WEB
- http://www.zerodayinitiative.com/advisories/ZDI-16-362WEB
- https://github.com/advisories/GHSA-872g-2h8h-362qADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2016-4800ADVISORY
- https://security.netapp.com/advisory/ntap-20190307-0006WEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan