CVE-2021-34429: eclipse jetty
Vulnerability summary
CVE-2021-34429 is a medium (CVSS 5.3) vulnerability in eclipse jetty. EPSS estimates a 99.30% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 15-07-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
99.30%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.30% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundJetty.Project
Maturity: poc
Eclipse Jetty 11.0.5 - Sensitive File Disclosure
Maturity: poc
Jetty WEB-INF File Disclosure
auxiliary/gather/jetty_web_inf_disclosure
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Affected systems
Oracle10 products
- autovue_for_agile_product_lifecycle_management21.0.2
- communications_cloud_native_core_binding_support_function1.10.0
- communications_cloud_native_core_security_edge_protection_proxy1.5.0
- communications_cloud_native_core_service_communication_proxy1.14.0
- communications_cloud_native_core_unified_data_repository1.14.0
Netapp7 products
- e-series_santricity_os_controller≥ 11.0, ≤ 11.70.1
- e-series_santricity_web_servicesna
- element_plug-in_for_vcenter_serverna
- hci_management_nodena
- snap_creator_frameworkna
Opensuse2 products
- jetty-minimal&distro=openSUSE Leap 15.3< 9.4.43-3.12.2
- jetty-websocket&distro=openSUSE Leap 15.3< 9.4.43-3.12.2
Suse2 products
- jetty-minimal&distro=SUSE Linux Enterprise Module for Development Tools 15 SP2< 9.4.43-3.12.2
- jetty-minimal&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 9.4.43-3.12.2
Debian1 product
- jetty9< 9.4.39-3
Eclipse1 product
- jetty≥ 9.4.37, < 9.4.43 | ≥ 10.0.1, < 10.0.6 | ≥ 11.0.1, < 11.0.6
Org.eclipse.jetty1 product
- jetty-webapp≥ 9.4.37, < 9.4.43 | ≥ 10.0.1, < 10.0.6 | ≥ 11.0.1, < 11.0.6
The eclipse foundation1 product
- eclipse jetty≥ 9.4.37, < unspecified | ≥ unspecified, ≤ 9.4.42 | ≥ 10.0.1, < unspecified | ≥ unspecified, ≤ 10.0.5 | ≥ 11.0.1, < unspecified | ≥ unspecified, ≤ 11.0.5
Ubuntu1 product
- jetty9All versions (No fix recorded)
9 vendors · 26 products
References
82 links- github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vmX Refsource CONFIRMREPORTWEBExploitThird Party Advisory
Show all 82 references
- lists.opensuse.org/archives/…Advisory
