vendor:
Jetty
by:
SecurityFocus
7.5
CVSS
HIGH
Arbitrary Command Execution
78
CWE
Product Name: Jetty
Affected Version From: Prior to 4.1.0
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: a:mortbay:jetty
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Microsoft Windows
2002
Jetty CGIServlet Arbitrary Command Execution Vulnerability
A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to execute attacker-specified commands (such as running executables on the host).
Mitigation:
Upgrade to Jetty version 4.1.0 or later.
