For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-jspc-maven-pluginUpgrade jetty-monitorUpgrade jetty-javadocUpgrade jetty-clientUpgrade jetty-websocket-parentUpgrade jetty-websocket-serverUpgrade jetty-securityUpgrade jetty-jaasUpgrade jetty-proxyUpgrade jetty-websocket-clientUpgrade jetty-rewriteUpgrade jetty-maven-pluginUpgrade jetty-ioUpgrade jetty-plusUpgrade jetty-websocket-commonUpgrade jetty-annotationsUpgrade jetty-deployUpgrade jetty-antUpgrade jetty-utilUpgrade jetty-projectUpgrade jetty-servletUpgrade jetty-jspUpgrade jetty-httpUpgrade jetty-webappUpgrade jetty-servletsUpgrade jetty-websocket-servletUpgrade jetty-jmxUpgrade jetty-util-ajaxUpgrade jetty-runnerUpgrade jetty-jaspiUpgrade jetty-serverUpgrade jetty-startUpgrade jetty-continuationUpgrade jetty-jndiUpgrade jetty-websocket-apiUpgrade jetty-xml | Jan 10, 2024 | Jun 9, 2021 |
| Debian | — | Upgrade jetty9 | Jun 21, 2021 | Jun 9, 2021 |
| Redhat Openshift | — | Upgrade jenkins | Oct 20, 2021 | Jun 8, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 9, 2021 |
| Suse | — | Upgrade jetty-continuationUpgrade jetty-jaasUpgrade jetty-javax-websocket-server-implUpgrade jetty-utilUpgrade jetty-minimal-javadocUpgrade jetty-openidUpgrade jetty-servletUpgrade jetty-websocket-clientUpgrade jetty-util-ajaxUpgrade jetty-websocket-javadocUpgrade jetty-jndiUpgrade jetty-proxyUpgrade jetty-jmxUpgrade jetty-websocket-apiUpgrade jetty-serverUpgrade jetty-httpUpgrade jetty-ioUpgrade jetty-plusUpgrade jetty-javax-websocket-client-implUpgrade jetty-websocket-serverUpgrade jetty-websocket-commonUpgrade jetty-securityUpgrade jetty-annotationsUpgrade jetty-jspUpgrade jetty-xmlUpgrade jetty-clientUpgrade jetty-websocket-servletUpgrade jetty-webapp | Jun 19, 2021 | Jun 9, 2021 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Jun 9, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub