CVE-2021-28169 - 漏洞详情

CVE-2021-28169 (CNNVD-202106-724)

MEDIUM

中文标题:

Eclipse Jetty 安全漏洞

英文标题:

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the Conca...

CVSS分数: 5.3

发布时间: 2021-06-09 01:55:09

漏洞类型: 其他

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty 中存在安全漏洞，该漏洞源于通过对ConcatServlet的双重编码路径请求访问WEB-INF目录中的受保护资源。以下产品及型号受到影响： Eclipse Jetty 9.4.40 版本及之前版本、Eclipse Jetty 10.0.2 版本及之前版本、Eclipse Jetty 11.0.2 版本及之前版本。

英文描述:

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CWE类型:

CWE-200

受影响产品

厂商	产品	版本	版本范围	平台	CPE
The Eclipse Foundation	Eclipse Jetty	-	≤ 9.4.40	-	`cpe:2.3:a:the_eclipse_foundation:eclipse_jetty::::::::`
eclipse	jetty	*	-	-	`cpe:2.3:a:eclipse:jetty::::::::`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
oracle	communications_cloud_native_core_policy	1.14.0	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*`
oracle	rest_data_services	*	-	-	`cpe:2.3:a:oracle:rest_data_services:::::-:::*`
netapp	active_iq_unified_manager	-	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::`
netapp	hci	-	-	-	`cpe:2.3:a:netapp:hci:-:::::::*`
netapp	management_services_for_element_software	-	-	-	`cpe:2.3:a:netapp:management_services_for_element_software:-:::::::*`
netapp	snap_creator_framework	-	-	-	`cpe:2.3:a:netapp:snap_creator_framework:-:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

无标题 x_refsource_CONFIRM
cve.org

访问

[kafka-users] 20210617 vulnerabilities mailing-list
cve.org

访问

[debian-lts-announce] 20210617 [SECURITY] [DLA 2688-1] jetty9 security update mailing-list
cve.org

访问

[kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41 mailing-list
cve.org

访问

[kafka-dev] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41 mailing-list
cve.org

访问

[kafka-jira] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41 mailing-list
cve.org

访问

[kafka-jira] 20210704 [GitHub] [kafka] ijuma commented on pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[kafka-jira] 20210704 [GitHub] [kafka] ijuma merged pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[kafka-dev] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41 mailing-list
cve.org

访问

[kafka-jira] 20210722 [jira] [Updated] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[kafka-jira] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41 mailing-list
cve.org

访问

DSA-4949 vendor-advisory
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 mailing-list
cve.org

访问