CVE-2016-4800 json
Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
published 2017-04-13 9 y ago modified 2026-06-17 4 mo ago also GHSA-872g-2h8h-362q , EUVD-2018-0545
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.5%
- EPSS 6.5% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Patch / fix
- maven org.eclipse.jetty:jetty-server 9.3.9
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-4800 updated cvss 5.0
jetty: path normalization
-
Red Hat Enterprise Linux 6 jetty-eclipse Red Hat Enterprise Linux 7 jetty-io, jetty-ant, jetty-jmx, jetty-jsp, jetty-xml, jetty-http, +30 more Red Hat JBoss A-MQ 6 jetty Red Hat JBoss BRMS 5 jetty Red Hat JBoss Data Virtualization 6 jetty Red Hat JBoss Enterprise Application Platform 5 jettynot affected: vulnerable code not present
+7 more productsfewer
Red Hat JBoss Fuse 6 jetty Red Hat JBoss Fuse Service Works 6 jetty Red Hat JBoss Portal 6 jetty Red Hat JBoss SOA Platform 5 jetty Red Hat OpenShift Enterprise 2 jetty-project Red Hat Satellite 6 jetty-project Red Hat Software Collections rh-java-common-jetty-io, rh-java-common-jetty-ant, rh-java-common-jetty-jmx, rh-java-common-jetty-jsp, rh-java-common-jetty-xml, rh-java-common-jetty-http, +30 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
6.54% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.eclipse.jetty:jetty-server | >=9.3.0, <9.3.9 |
9.3.9 |
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
dev.eclipse.org
/mhonarc/lists/jetty-announce/msg00092.html
mailing-list, web, patch, vendor-advisory
-
ocert.org
/advisories/ocert-2016-001.html
web, mitigation, patch, third-party-advisory
-
securityfocus.com
/bid/90945
vdb-entry, web, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2020.html
web
- security.netapp.com /advisory/ntap-20190307-0006/
-
zerodayinitiative.com
/advisories/ZDI-16-362
web, third-party-advisory, vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2016-4800
advisory
-
github.com
/advisories/GHSA-872g-2h8h-362q
advisory
-
security.netapp.com
/advisory/ntap-20190307-0006
web
Sources
- CVE List CVE-2016-4800
- GitHub Advisory GHSA-872g-2h8h-362q
- NVD CVE-2016-4800
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.