Jetty 3.1.6/3.1.7/4.1 Servlet Engine - Arbitrary Command Execution

source: https://www.securityfocus.com/bid/5852/info

A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to execute attacker-specified commands (such as running executables on the host).

This vulnerability affects Jetty versions for Microsoft Windows prior to 4.1.0.

http://jetty-server:8080/cgi-bin/..\..\..\..\..\..\winnt/notepad.exe