CVE-2021-28169 @ Maven-org.eclipse.jetty:jetty-http-9.4.12.RC0

[cxronen]

Vulnerable Package issue exists @ Maven-org.eclipse.jetty:jetty-http-9.4.12.RC0 in branch main

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Namespace: cxronen
Repository: BookStore
Repository Url: https://github.com/cxronen/BookStore
CxAST-Project: cxronen/BookStore
CxAST platform scan: 963948e5-2563-4394-a6e0-69e8178cd78c
Branch: main
Application: BookStore
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-200

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 9.4.47.v20220610

---

References
Advisory
Commit
Commit
Issue
Pull request
Pull request