Skip to content
OpenAdvisories

Package · Maven

org.eclipse.jetty:jetty-webapp

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2021-34429 Public exploit Scanner template EPSS 99%

    Encoded URIs can access WEB-INF directory in Eclipse Jetty

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reporte…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-28164 Public exploit Scanner template EPSS 82%

    Authorization Before Parsing and Canonicalization in jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

    The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven