CVE-2021-28169

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected

The Eclipse Foundation · Eclipse Jetty

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

78.48% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium

Published

2021-06-09

Updated

2024-08-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28169.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/jetty/CVE-2021-28169

Exploit collections (1)

• CVE-2021-28169.yamlzan8in/afrog

Security advisories

• eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
• https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html
• https://security.netapp.com/advisory/ntap-20210727-0009
• https://www.debian.org/security/2021/dsa-4949
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• advisories/GHSA-gwcr-j4wh-j3cq

References

• CVE Record
• NVD entry