CVE-2016-0709 in the critical feed json
Path Traversal in Apache Jetspeed
published 2016-04-11 10 y ago modified 2026-06-17 4 mo ago also GHSA-w47p-5q88-hj5g , EUVD-2022-5493
- cvss
- 7.2
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 77.5%
- EPSS 77.5% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
Patch / fix
- maven org.apache.portals.jetspeed-2:jetspeed 2.3.1
Timeline
- First public exploit (Metasploit exploit/multi/http/apache_jetspeed_file_upload)
- Published
Exploit prediction
77.50% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/http/apache_jetspeed_file_upload Apache Jetspeed Arbitrary File Upload metasploit exploit, manual rank, 2016-03-06
- EDB-39643 Apache Jetspeed - Arbitrary File Upload (Metasploit) remote, 2016-03-31
- haxx.ml http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
| GitHub | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.portals.jetspeed-2:jetspeed | <2.3.1 |
2.3.1 |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
exploit-db.com
/exploits/39643/
exploit
-
haxx.ml
/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
web, exploit
-
packetstormsecurity.com
/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html
web, exploit
-
portals.apache.org
/jetspeed-2/security-reports.html#CVE-2016-0709
web, vendor-advisory
-
mail-archives.apache.org
/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677%40bluesunrise.com%3E
mailing-list
-
rapid7.com
/db/modules/exploit/multi/http/apache_jetspeed_file_upload
web
-
nvd.nist.gov
/vuln/detail/CVE-2016-0709
advisory
-
mail-archives.apache.org
/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677@bluesunrise.com%3E
web
-
exploit-db.com
/exploits/39643
web
Sources
- CVE List CVE-2016-0709
- GitHub Advisory GHSA-w47p-5q88-hj5g
- NVD CVE-2016-0709
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.