For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-httpUpgrade jetty-webappUpgrade jetty-jmxUpgrade jetty-serverUpgrade jetty-runnerUpgrade jetty-xmlUpgrade jetty-continuationUpgrade jetty-servletsUpgrade jetty-jndiUpgrade jetty-util-ajaxUpgrade jetty-websocket-apiUpgrade jetty-jaspiUpgrade jetty-websocket-servletUpgrade jetty-startUpgrade jetty-utilUpgrade jetty-websocket-parentUpgrade jetty-rewriteUpgrade jetty-maven-pluginUpgrade jetty-websocket-commonUpgrade jetty-websocket-serverUpgrade jetty-websocket-clientUpgrade jetty-ioUpgrade jetty-proxyUpgrade jetty-jspUpgrade jetty-monitorUpgrade jetty-antUpgrade jetty-securityUpgrade jetty-servletUpgrade jetty-deployUpgrade jetty-projectUpgrade jetty-clientUpgrade jetty-jspc-maven-pluginUpgrade jetty-annotationsUpgrade jetty-plusUpgrade jetty-jaasUpgrade jetty-javadoc | Jan 10, 2024 | Jun 9, 2021 |
| Debian | — | Upgrade jetty9 | Jun 21, 2021 | Jun 9, 2021 |
| Redhat Openshift | — | Upgrade jenkins | Oct 20, 2021 | Jun 8, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 9, 2021 |
| Suse | — | Upgrade jetty-securityUpgrade jetty-ioUpgrade jetty-httpUpgrade jetty-websocket-serverUpgrade jetty-jspUpgrade jetty-clientUpgrade jetty-javax-websocket-client-implUpgrade jetty-xmlUpgrade jetty-plusUpgrade jetty-webappUpgrade jetty-websocket-servletUpgrade jetty-annotationsUpgrade jetty-websocket-commonUpgrade jetty-javax-websocket-server-implUpgrade jetty-proxyUpgrade jetty-openidUpgrade jetty-websocket-apiUpgrade jetty-servletUpgrade jetty-jmxUpgrade jetty-jndiUpgrade jetty-serverUpgrade jetty-websocket-clientUpgrade jetty-util-ajaxUpgrade jetty-utilUpgrade jetty-continuationUpgrade jetty-websocket-javadocUpgrade jetty-minimal-javadocUpgrade jetty-jaas | Jun 19, 2021 | Jun 9, 2021 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Jun 9, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub