{"id":"CVE-2016-4800","details":"The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.","aliases":["GHSA-872g-2h8h-362q"],"modified":"2026-09-06T03:45:04.117818062Z","published":"2017-04-13T14:59:01.760Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"9.3.1"},{"last_affected":"9.3.1"},{"introduced":"9.3.1"},{"last_affected":"9.3.1"},{"introduced":"9.3.1"},{"last_affected":"9.3.1"},{"introduced":"9.3.2"},{"last_affected":"9.3.2"},{"introduced":"9.3.2"},{"last_affected":"9.3.2"},{"introduced":"9.3.2"},{"last_affected":"9.3.2"},{"introduced":"9.3.3"},{"last_affected":"9.3.3"},{"introduced":"9.3.3"},{"last_affected":"9.3.3"},{"introduced":"9.3.3"},{"last_affected":"9.3.3"},{"introduced":"9.3.4"},{"last_affected":"9.3.4"},{"introduced":"9.3.4"},{"last_affected":"9.3.4"},{"introduced":"9.3.4"},{"last_affected":"9.3.4"},{"introduced":"9.3.8"},{"last_affected":"9.3.8"},{"introduced":"9.3.8"},{"last_affected":"9.3.8"},{"introduced":"9.3.8"},{"last_affected":"9.3.8"}],"source":"CPE_STRING","vendor_product":"eclipse:jetty","cpes":["cpe:2.3:a:eclipse:jetty:9.3.1:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.2:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.3:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.8:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/90945"},{"type":"ADVISORY","url":"http://www.zerodayinitiative.com/advisories/ZDI-16-362"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20190307-0006/"},{"type":"FIX","url":"http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html"},{"type":"FIX","url":"http://www.ocert.org/advisories/ocert-2016-001.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jetty/jetty.project","events":[{"introduced":"390f3200cce7f90f1f3ebc78013c1afea2f93db8"},{"last_affected":"bee564c7d942447f02e8d87a2ea5fe30e651a59c"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:eclipse:jetty:9.3.0:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.5:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.6:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.7:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.3.0"},{"last_affected":"9.3.0"},{"introduced":"9.3.0-m0"},{"last_affected":"9.3.0-m0"},{"introduced":"9.3.0-m1"},{"last_affected":"9.3.0-m1"},{"introduced":"9.3.0-maintenance2"},{"last_affected":"9.3.0-maintenance2"},{"introduced":"9.3.0-rc0"},{"last_affected":"9.3.0-rc0"},{"introduced":"9.3.0-rc1"},{"last_affected":"9.3.0-rc1"},{"introduced":"9.3.4-rc0"},{"last_affected":"9.3.4-rc0"},{"introduced":"9.3.4-rc1"},{"last_affected":"9.3.4-rc1"},{"introduced":"9.3.5"},{"last_affected":"9.3.5"},{"introduced":"9.3.6"},{"last_affected":"9.3.6"},{"introduced":"9.3.7"},{"last_affected":"9.3.7"},{"introduced":"9.3.7-rc0"},{"last_affected":"9.3.7-rc0"},{"introduced":"9.3.7-rc1"},{"last_affected":"9.3.7-rc1"},{"introduced":"9.3.8-rc0"},{"last_affected":"9.3.8-rc0"}]}}],"versions":["9.3.0","9.3.0-m1","9.3.0-maintenance2","9.3.0-rc0","9.3.0-rc1","9.3.4-rc0","9.3.4-rc1","9.3.5","9.3.6","9.3.7","9.3.7-rc0","9.3.7-rc1","9.3.8-rc0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4800.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}