Path Traversal Vulnerability in Eclipse Jetty by Eclipse Foundation
CVE-2021-28169

5.3MEDIUM

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
9 June 2021

What is CVE-2021-28169?

Eclipse Jetty versions up to 9.4.40, 10.0.2, and 11.0.2 are susceptible to a path traversal vulnerability which allows attackers to craft requests with doubly encoded paths targeting the ConcatServlet. This leads to the exposure of sensitive resources within the WEB-INF directory, including critical configuration files such as web.xml. Attackers can exploit this flaw to gain insights into the application's structure and sensitive implementation details, posing significant risks to the security of the web application.

Affected Version(s)

Eclipse Jetty <= 9.4.40

Eclipse Jetty <= 10.0.2

Eclipse Jetty <= 11.0.2

References

https://github.com/eclipse/jetty.project/security/advisor...
x_refsource_CONFIRM
https://lists.apache.org/thread.html/r2721aba31a8562639c4...
mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2021/06/msg0...
mailing-listx_refsource_MLIST

EPSS Score

92% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.