CVE-2021-28169 @ Maven-org.eclipse.jetty:jetty-http-9.4.12.RC0

[cxronen]

Vulnerable Package issue exists @ Maven-org.eclipse.jetty:jetty-http-9.4.12.RC0 in branch master

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: a4db4310-8373-454d-9747-32190143f6b0
Branch: master
Application: BookStore_VSCode
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-200

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 9.4.47.v20220610

---

References
Advisory
Commit
Commit
Issue
Pull request
Pull request