CVE-2016-4800

—

CVSS 3.0

9.8 critical

EPSS

6%p93

Published

Apr 13, 2017 (Apr 13, 2017)

Modified

Jun 17, 2026

Description

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Vendors: eclipse
Products: jetty
Weakness: CWE-284
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (6.4%)

In the news0 stories

No ingested article mentions this CVE yet.