7 lines
No EOL
495 B
Text
7 lines
No EOL
495 B
Text
source: http://www.securityfocus.com/bid/5852/info
|
|
|
|
A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to execute attacker-specified commands (such as running executables on the host).
|
|
|
|
This vulnerability affects Jetty versions for Microsoft Windows prior to 4.1.0.
|
|
|
|
http://jetty-server:8080/cgi-bin/..\..\..\..\..\..\winnt/notepad.exe |