Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

Also known as GHSA-872g-2h8h-362q

Published 9 y ago 2017-04-13 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

6.4%

percentile 94%

Public exploits

none known

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Exploit prediction (EPSS)

6.36% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.eclipse.jetty:jetty-server`	>=9.3.0, <9.3.9	9.3.9

Classification

Weakness

CWE-284 Improper Access Control

References

dev.eclipse.org /mhonarc/lists/jetty-announce/msg00092.html · mailing-list, x_refsource_MLIST, x_transferred
securityfocus.com /bid/90945 · vdb-entry, x_refsource_BID, x_transferred
oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
ocert.org /advisories/ocert-2016-001.html · x_refsource_MISC, x_transferred
security.netapp.com /advisory/ntap-20190307-0006/ · x_refsource_CONFIRM, x_transferred
zerodayinitiative.com /advisories/ZDI-16-362 · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-4800 · advisory
github.com /advisories/GHSA-872g-2h8h-362q · advisory
security.netapp.com /advisory/ntap-20190307-0006 · web

Sources

CVE List: CVE-2016-4800
GitHub Advisory: GHSA-872g-2h8h-362q
NVD: CVE-2016-4800

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.