CVE-2021-28169

For Eclipse Jetty versions

Summary

Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

Original description

The description as published by the source.

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Maven org.eclipse.jetty:jetty-servlets

[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.3"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-28169 jetty9 Fixed in: 9.4.39-2

References

Metadata

CVE: CVE-2021-28169
GHSA: GHSA-gwcr-j4wh-j3cq
Published: 2021-06-09
First seen on SecPulse: 5 years ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-200

Detection sources

OSV.dev (Open Source Vulnerabilities) 1 month ago