Critical severity · published Apr 13, 2017
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other…
9.8
CVSS
6.4%
EPSS
No
On KEV
Description
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jetty · Eclipse
9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; +13 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4800
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4800
Patch
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html
Mitigation
http://www.ocert.org/advisories/ocert-2016-001.html
Third Party Advisory
http://www.securityfocus.com/bid/90945
Third Party Advisory
http://www.zerodayinitiative.com/advisories/ZDI-16-362
security.netapp.com
https://security.netapp.com/advisory/ntap-20190307-0006/
www.oracle.com
https://www.oracle.com/security-alerts/cpuoct2020.html
More from Jetty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…
9.8
CVE-2017-7657
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…
9.4
CVE-2019-17638
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error
9.1
CVE-2026-10050
Digest authentication lossy encoding