Jetty 3.1.6/3.1.7/4.1 Servlet Engine - Arbitrary Command Execution

                							

                source: http://www.securityfocus.com/bid/5852/info

A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to execute attacker-specified commands (such as running executables on the host).

This vulnerability affects Jetty versions for Microsoft Windows prior to 4.1.0.

http://jetty-server:8080/cgi-bin/..\..\..\..\..\..\winnt/notepad.exe