5.3
Medium
CVE-2021-34429 For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded…
Description
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Jetty 11.0 | earliest → latest | No fix stated |
| Eclipse Jetty 10.0 | earliest → latest | No fix stated |
| Eclipse Jetty 9.4 | earliest → latest | No fix stated |
Other CVEs of Eclipse Jetty
The 23 CVEs of Eclipse Jetty →
CVE-2022-2191
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release…
7.5
High
CVE-2022-2047
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the…
2.7
Low
CVE-2022-2048
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug…
7.5
High
CVE-2021-34428
For Eclipse Jetty…
2.9
Low