CVE-2021-34429
PoC —CVSS 3.1
5.3 medium
EPSS
99%p100
Published
()
Modified
Description
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
- Vendors
- eclipsenetapporacle
- Products
- jetty, e-series santricity os controller, e-series santricity web services, element plug-in for vcenter server, hci management node, snap creator framework, snapcenter plug-in, solidfire, autovue for agile product lifecycle management, communications cloud native core binding support function, communications cloud native core security edge protection proxy, communications cloud native core service communication proxy
- Weakness
- CWE-200, CWE-551
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
In the news0 stories
No ingested article mentions this CVE yet.