CVE-2016-4800: Critical severity mortbay jetty vulnerability
Published Apr 13, 2017
·Updated
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Affected Software
20 affected components
Mortbay Jetty=9.3.0
Mortbay Jetty=9.3.0-m0
Mortbay Jetty=9.3.0-m1
Mortbay Jetty=9.3.0-maintenance2
Mortbay Jetty=9.3.0-rc0
Mortbay Jetty=9.3.0-rc1
Mortbay Jetty=9.3.1
Mortbay Jetty=9.3.2
Mortbay Jetty=9.3.3
Mortbay Jetty=9.3.4
Mortbay Jetty=9.3.4-rc0
Mortbay Jetty=9.3.4-rc1
Mortbay Jetty=9.3.5
Mortbay Jetty=9.3.6
Mortbay Jetty=9.3.7
Mortbay Jetty=9.3.7-rc0
Mortbay Jetty=9.3.7-rc1
Mortbay Jetty=9.3.8
Mortbay Jetty=9.3.8-rc0
Microsoft Windows
Remediation
Patch Available
Event History
Apr 13, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4800?
CVE-2016-4800 has a medium severity level as it allows attackers to bypass resource protection.
2
How do I fix CVE-2016-4800?
To fix CVE-2016-4800, upgrade to Eclipse Jetty version 9.3.9 or later.
3
Which versions of Eclipse Jetty are affected by CVE-2016-4800?
CVE-2016-4800 affects Eclipse Jetty versions 9.3.0 through 9.3.8.
4
What type of vulnerability is CVE-2016-4800?
CVE-2016-4800 is a path normalization vulnerability affecting protected resources.
5
Can CVE-2016-4800 be exploited on operating systems other than Windows?
CVE-2016-4800 specifically targets Eclipse Jetty running on Windows systems.