CVE-2002-1178 Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\ (dot-dot backslash) sequences in an HTTP request to...
MediumCVSS 5.0
EPSS 9.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0 allows remote attackers to execute arbitrary commands via ..\ (dot-dot backslash) sequences in an HTTP request to the cgi-bin directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jetty http server | <= 4.1.0 | No fix listed |
References
- groups.yahoo.com vendor-advisory
- 20021002 wp-02-0011: Jetty CGIServlet Arbitrary Command Execution mailing-list
- jetty-cgiservlet-directory-traversal(10246) vdb-entry vendor-advisory
- 5852 exploit patch vdb-entry vendor-advisory
- www.westpoint.ltd.uk