Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Jetty Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2021-28169 - Vulnerability Database
Jetty

Jetty Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2021-28169

Medium
Reference: CVE-2021-28169
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2021-28169
Title: Jetty Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Overview:

For Eclipse Jetty versions lt 9.4.40 lt 10.0.2 lt 11.0.2 it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat/2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.