CVE-2021-34429
Medium
Description
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Eclipse Jetty
PublishedJul 15, 2021
First seenJul 15, 2021
Weakness typeCWE-200Sensitive information exposureCWE-551CWE-551
How to fix
Update
- eclipse jetty9.4.43, 10.0.6, 11.0.6 or later
- oracle rest_data_services22.1.1 or later
- oracle stream_analytics19.1.0.0.6.4 or later
- org.eclipse.jetty:jetty-webapp9.4.43, 10.0.6, 11.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.4.37 ≤ v < 9.4.43, 10.0.1 ≤ v < 10.0.6, 11.0.1 ≤ v < 11.0.6 | 9.4.43, 10.0.6, 11.0.6 |
| netapp e-series_santricity_os_controller | 11.0 ≤ v ≤ 11.70.1 | — |
| netapp e-series_santricity_web_services | No range specified | — |
| netapp element_plug-in_for_vcenter_server | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapcenter_plug-in | No range specified | — |
| netapp solidfire | No range specified | — |
| oracle autovue_for_agile_product_lifecycle_management | 21.0.2 | — |
| oracle communications_cloud_native_core_binding_support_function | 1.10.0 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 1.5.0 | — |
| oracle communications_cloud_native_core_service_communication_proxy | 1.14.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.14.0 | — |
| oracle communications_diameter_signaling_router | 8.0.0.0 ≤ v ≤ 8.5.0.2 | — |
| oracle financial_services_crime_and_compliance_management_studio | 8.0.8.2.0, 8.0.8.3.0 | — |
| oracle rest_data_services | v < 22.1.1 | 22.1.1 |
| oracle retail_eftlink | 20.0.1 | — |
| oracle stream_analytics | v < 19.1.0.0.6.4, 19c | 19.1.0.0.6.4 |
| org.eclipse.jetty:jetty-webappMaven | 9.4.37 ≤ v < 9.4.43, 10.0.1 ≤ v < 10.0.6, 11.0.1 ≤ v < 11.0.6 | 9.4.43, 10.0.6, 11.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.