CVE-2021-34429

The Eclipse Foundation Eclipse Jetty

MEDIUM 5.3

At a glance

Source: NVD
EPSS: EPSS 99.33 % · percentile 100 (2026-10-28)
State: PUBLISHED
Published: 2021-07-15 17:00 UTC
Updated: 2024-08-04 00:12 UTC
Assigner: eclipse
NVD status: Modified

Description

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Weaknesses (CWE)

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
CWE-551 — Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	eclipse
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · emo@eclipse.org (Secondary)
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-vjv5-gp2w-65vm — Encoded URIs can access WEB-INF directory in Eclipse Jetty

European references

ENISA EUVD · EUVD-2021-1493
GCVE · GCVE-0-2021-34429

CERT-FR advisories

CERTFR-2022-AVI-767 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-523 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 9.4.37 < 9.4.43
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 10.0.1 < 10.0.6
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 11.0.1 < 11.0.6
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0 ≤ 11.70.1
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* ≥ 8.0.0.0 ≤ 8.5.0.2
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* < 22.1.1
cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:* < 19.1.0.0.6.4
cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:*

Affected products

Product	Versions
The Eclipse Foundation · Eclipse Jetty	affected 9.4.37 < unspecified ; affected unspecified ≤ 9.4.42 ; affected 10.0.1 < unspecified ; affected unspecified ≤ 10.0.5 ; affected 11.0.1 < unspecified ; affected unspecified ≤ 11.0.5

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD