CVE-2021-28169 @ Maven-org.eclipse.jetty:jetty-http-9.4.12.RC0

[cxronen]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2021-28169
Checkmarx Project: cxronen/BookStore_VSCode
Repository URL: https://github.com/cxronen/BookStore_VSCode
Branch: master
Scan ID: 7c24212b-2b21-4248-ba1f-b86776f5d0c2

---

For Eclipse Jetty versions through 9.4.40, 10.0.0 through 10.0.2, 11.0.0 through 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to "/concat?/%2557EB-INF/web.xml" can retrieve the "web.xml" file. This can reveal sensitive information regarding the implementation of a web application.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 9.4.51.v20230217