Vulnerability CVE-2021-28169

Vulnerability Name:

CVE-2021-28169 (CCN-203492)

Assigned:

2021-06-08

Published:

2021-06-08

Updated:

2022-10-25

Summary:

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS v3 Severity:

5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Obtain Information

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:eclipse:jetty:*:*:*:*:*:*:*:* (Version < 9.4.41)

OR cpe:/a:eclipse:jetty:*:*:*:*:*:*:*:* (Version >= 10.0.0 and < 10.0.3)

OR cpe:/a:eclipse:jetty:*:*:*:*:*:*:*:* (Version >= 11.0.0 and < 11.0.3)

Configuration 2:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:oracle:rest_data_services:*:*:*:*:-:*:*:* (Version < 21.3)

OR cpe:/a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*

OR cpe:/a:netapp:hci:-:*:*:*:*:*:*:*

OR cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*

OR cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

OR cpe:/a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:eclipse:jetty:9.4.40:*:*:*:*:*:*:*

OR cpe:/a:eclipse:jetty:10.0.2:*:*:*:*:*:*:*

OR cpe:/a:eclipse:jetty:11.0.2:*:*:*:*:*:*:*

AND

cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_functional_tester:9.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:mq:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:mq:9.1.0:*:*:*:continuous_delivery:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*

OR cpe:/a:ibm:rational_service_tester:9.5:*:*:*:soa_quality:*:*:*

OR cpe:/a:ibm:mq:9.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:sterling_b2b_integrator:6.1.1.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:8024	P	jetty-http-9.4.48-150200.3.16.3 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:95293	P	Security update for java-17-openjdk (Important)	2022-08-03
oval:org.opensuse.security:def:3395	P	vsftpd-3.0.2-40.11.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94894	P	evince-41.3-150400.1.11 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95025	P	jetty-http-9.4.43-3.12.2 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:6065	P	Security update for gcc48 (Moderate)	2022-06-08
oval:org.opensuse.security:def:102006	P	Security update for the Linux Kernel (Live Patch 12 for SLE 15 SP3) (Critical)	2022-02-16
oval:org.opensuse.security:def:101607	P	Security update for qemu (Low)	2022-01-25
oval:org.opensuse.security:def:112474	P	jetty-annotations-9.4.43-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105971	P	jetty-annotations-9.4.43-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:4485	P	Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP5) (Important)	2021-09-16
oval:org.opensuse.security:def:111590	P	Security update for jetty-minimal (Important)	2021-07-11
oval:org.opensuse.security:def:65574	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:4555	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:97080	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:117787	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:74712	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:108273	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:101782	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:65644	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:5745	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:75902	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:108672	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:66834	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:76222	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:67154	P	Security update for jetty-minimal (Important)	2021-06-17
oval:org.opensuse.security:def:74642	P	Security update for jetty-minimal (Important)	2021-06-17

BACK