For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-jaasUpgrade jetty-utilUpgrade jetty-securityUpgrade jetty-javadocUpgrade jetty-websocket-parentUpgrade jetty-rewriteUpgrade jetty-plusUpgrade jetty-proxyUpgrade jetty-websocket-clientUpgrade jetty-ioUpgrade jetty-websocket-serverUpgrade jetty-clientUpgrade jetty-deployUpgrade jetty-servletUpgrade jetty-projectUpgrade jetty-monitorUpgrade jetty-jspUpgrade jetty-antUpgrade jetty-websocket-commonUpgrade jetty-annotationsUpgrade jetty-maven-pluginUpgrade jetty-jspc-maven-pluginUpgrade jetty-continuationUpgrade jetty-websocket-servletUpgrade jetty-servletsUpgrade jetty-runnerUpgrade jetty-xmlUpgrade jetty-util-ajaxUpgrade jetty-jmxUpgrade jetty-webappUpgrade jetty-jaspiUpgrade jetty-serverUpgrade jetty-websocket-apiUpgrade jetty-httpUpgrade jetty-startUpgrade jetty-jndi | Jan 10, 2024 | Jun 9, 2021 |
| Debian | — | Upgrade jetty9 | Jun 21, 2021 | Jun 9, 2021 |
| Redhat Openshift | — | Upgrade jenkins | Oct 20, 2021 | Jun 8, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 9, 2021 |
| Suse | — | Upgrade jetty-xmlUpgrade jetty-clientUpgrade jetty-jspUpgrade jetty-webappUpgrade jetty-ioUpgrade jetty-websocket-servletUpgrade jetty-javax-websocket-client-implUpgrade jetty-plusUpgrade jetty-annotationsUpgrade jetty-httpUpgrade jetty-websocket-serverUpgrade jetty-websocket-commonUpgrade jetty-securityUpgrade jetty-proxyUpgrade jetty-websocket-clientUpgrade jetty-websocket-apiUpgrade jetty-util-ajaxUpgrade jetty-jndiUpgrade jetty-openidUpgrade jetty-continuationUpgrade jetty-minimal-javadocUpgrade jetty-jmxUpgrade jetty-serverUpgrade jetty-websocket-javadocUpgrade jetty-utilUpgrade jetty-jaasUpgrade jetty-javax-websocket-server-implUpgrade jetty-servlet | Jun 19, 2021 | Jun 9, 2021 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Jun 9, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub