5.3
Medium
CVE-2021-28169 For Eclipse Jetty…
Description
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Jetty 11.0 | earliest → 11.0.2 | No fix stated |
| Eclipse Jetty 10.0 | earliest → 10.0.2 | No fix stated |
| Eclipse Jetty 9.4 | earliest → 9.4.40 | No fix stated |
Other CVEs of Eclipse Jetty
The 23 CVEs of Eclipse Jetty →
CVE-2022-2191
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release…
7.5
High
CVE-2022-2047
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the…
2.7
Low
CVE-2022-2048
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug…
7.5
High
CVE-2021-34429
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded…
5.3
Medium