CVE-2021-34429

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Affected

The Eclipse Foundation · Eclipse Jetty

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

99.30% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium

Published

2021-07-15

Updated

2024-08-04

Proof-of-concept exploits (1)

• ColdFusionX/CVE-2021-344296★ · 2021-11-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34429.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50478

Vulhub environments (1)

• vulhub/vulhub/tree/master/jetty/CVE-2021-34429

Security advisories

• eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
• https://security.netapp.com/advisory/ntap-20210819-0006
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• advisories/GHSA-vjv5-gp2w-65vm

References

• CVE Record
• NVD entry

Related

• CVE-2019-11447
• CVE-2019-17240
• CVE-2020-10770
• CVE-2020-9484
• CVE-2021-26085
• CVE-2021-26086