For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.88841.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
The Eclipse Foundation Eclipse Jetty affected
Version Status Constraints
unspecified affected ≤ 9.4.40
unspecified affected ≤ 10.0.2
unspecified affected ≤ 11.0.2

Configuration 1 [-]

OR cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat AMQ 7.9.0
jetty-server cpe:/a:redhat:amq_broker:7 RHSA-2021:3700 2021-09-30T00:00:00Z
Red Hat AMQ Streams 1.8.0
jetty-server cpe:/a:redhat:amq_streams:1 RHSA-2021:3225 2021-08-19T00:00:00Z
Red Hat Fuse 7.10
jetty cpe:/a:redhat:jboss_fuse:7 RHSA-2021:5134 2021-12-14T00:00:00Z
Red Hat Integration Camel Quarkus 1
jetty cpe:/a:redhat:camel_quarkus:2.2 RHSA-2021:4767 2021-11-23T00:00:00Z
Red Hat OpenShift Container Platform 4.9
jenkins-0:2.289.3.1630554997-1.el8 cpe:/a:redhat:openshift:4.9::el8 RHSA-2021:3758 2021-10-18T00:00:00Z
RHINT Camel-K 1.8.1
jetty cpe:/a:redhat:integration:1 RHSA-2022:7257 2022-10-27T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Debian Subscribe
Debian Linux Subscribe
Eclipse Subscribe
Jetty Subscribe
Netapp Subscribe
Active Iq Unified Manager Subscribe
Hci Subscribe
Management Services For Element Software Subscribe
Snap Creator Framework Subscribe
Oracle Subscribe
Communications Cloud Native Core Policy Subscribe
Rest Data Services Subscribe
Redhat Subscribe
Amq Broker Subscribe
Amq Streams Subscribe
Camel Quarkus Subscribe
Integration Subscribe
Jboss Fuse Subscribe
Openshift Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2688-1 jetty9 security update
Github GHSA Github GHSA GHSA-gwcr-j4wh-j3cq Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq cve-icon cve-icon
https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b%40%3Cdev.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4%40%3Cdev.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5%40%3Cdev.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-28169 cve-icon
https://security.netapp.com/advisory/ntap-20210727-0009/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-28169 cve-icon
https://www.debian.org/security/2021/dsa-4949 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2024-08-03T21:40:12.267Z

Reserved: 2021-03-12T00:00:00

Link: CVE-2021-28169

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-06-09T02:15:06.853

Modified: 2024-11-21T05:59:14.710

Link: CVE-2021-28169

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-06-08T00:00:00Z

Links: CVE-2021-28169 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses