Skip to content
OpenAdvisories

Package · Maven

org.eclipse.jetty:jetty-webapp

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.3
    CVE-2021-34429 Public exploit Scanner template EPSS 99%

    Encoded URIs can access WEB-INF directory in Eclipse Jetty

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reporte…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-28164 Public exploit Scanner template EPSS 82%

    Authorization Before Parsing and Canonicalization in jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

    The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven
  • High 7.0
    CVE-2020-27216

    Local Temp Directory Hijacking Vulnerability

    In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the pr…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven