CVE-2021-34429CWE-200CWE-551
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF…
Medium · published July 15, 2021
Patch now
High probability of exploitation
CVSS calls it medium at 5.3. It sits in the 99.9th percentile for exploit probability.
What it is
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.99330 · 99.9th percentile
- Weaknesses
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
- Published
- 2021-07-15T17:00Z
EPSS history
Timeline