Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-872G-2H8H-362Q
HistoryOct 19, 2018 - 4:16 p.m.

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

2018-10-1916:16:16
CWE-284
GitHub Advisory Database
github.com
8

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.014

Percentile

86.8%

JSON

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Affected configurations

Vulners
Node
org.eclipse.jetty\jettyMatchserver
VendorProductVersionCPE
org.eclipse.jetty\jettyservercpe:2.3:a:org.eclipse.jetty\:jetty:server:*:*:*:*:*:*:*:*

Related

redhatcve 1
prion 1
nvd 1
ubuntucve 1
osv 2
debiancve 1
cvelist 1
zdi 1
cve 1
ibm 2
oracle 1
redhatcve
redhatcve
CVE-2016-4800
2016-05-30 13:48:43
prion
prion
Design/Logic Flaw
2017-04-13 14:59:00
nvd
nvd
CVE-2016-4800
2017-04-13 14:59:01
ubuntucve
ubuntucve
CVE-2016-4800
2017-04-13 00:00:00
osv
osv
CVE-2016-4800
2017-04-13 14:59:01
Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
2018-10-19 16:16:16
debiancve
debiancve
CVE-2016-4800
2017-04-13 14:59:01
cvelist
cvelist
CVE-2016-4800
2017-04-13 14:00:00
zdi
zdi
Eclipse Jetty Protected Resource Bypass Vulnerability
2016-06-03 00:00:00
cve
cve
CVE-2016-4800
2017-04-13 14:59:01
ibm
ibm
Security Bulletin: IBM Security Verify Governance is vulnerable to multiple vulnerabilities due to Eclipse Jetty
2023-01-11 08:08:02
Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management
2024-02-14 08:43:22
oracle
oracle
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.014

Percentile

86.8%

JSON
Related for GHSA-872G-2H8H-362Q
redhatcve1prion1nvd1ubuntucve1osv2debiancve1cvelist1zdi1cve1ibm2oracle1