CVE-2021-34429

🗓️ 15 Jul 2021 17:00:10Reported by eclipseType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 381 Views

Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 allow crafted URIs to access WEB-INF dir & bypass security

Reporter	Title	Published	Views	Family All 91
IBM Security Bulletins	Security Bulletin: IBM Secure External Authentication Server is vulnerable to multiple issues due to Eclipse Jetty	29 Jul 202217:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator vulnerable due to Eclipse Jetty	17 Oct 202213:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues	24 Jun 202216:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	20 Mar 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Eclipse Jetty	29 Jul 202217:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM InfoSphere Information Server	17 May 202302:32	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	29 Mar 202206:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Mobile Enterprise Gateway uses Eclipse Jetty with multiple known vulnerabilities	6 Jun 202218:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Rational Change 5.3.2 Fix Pack 04 and earlier versions.	11 Oct 202208:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eclipse Jetty affect Rational Performance Tester (CVE-2021-28169, CVE-2021-34428, CVE-2021-28163, CVE-2021-28164, CVE-2021-34429, CVE-2021-28165)	29 Jul 202220:31	–	ibm

NVD

Node

eclipse jettyRange9.4.37–9.4.43

eclipse jettyRange10.0.1–10.0.6

eclipse jettyRange11.0.1–11.0.6

Node

netapp e-series_santricity_os_controllerRange11.0–11.70.1

netapp e-series_santricity_web_servicesMatch-web_services_proxy

netapp element_plug-in_for_vcenter_serverMatch-

netapp hci_management_nodeMatch-

netapp snap_creator_frameworkMatch-

netapp snapcenter_plug-inMatch-vmware_vsphere

netapp solidfireMatch-

Node

oracle autovue_for_agile_product_lifecycle_managementMatch21.0.2

oracle communications_cloud_native_core_binding_support_functionMatch1.10.0

oracle communications_cloud_native_core_security_edge_protection_proxyMatch1.5.0

oracle communications_cloud_native_core_service_communication_proxyMatch1.14.0

oracle communications_cloud_native_core_unified_data_repositoryMatch1.14.0

oracle communications_diameter_signaling_routerRange8.0.0.0–8.5.0.2

oracle financial_services_crime_and_compliance_management_studioMatch8.0.8.2.0

oracle financial_services_crime_and_compliance_management_studioMatch8.0.8.3.0

oracle rest_data_servicesRange<22.1.1-

oracle retail_eftlinkMatch20.0.1

oracle stream_analyticsRange<19.1.0.0.6.4

oracle stream_analyticsMatch19c

[
  {
    "product": "Eclipse Jetty",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.4.37",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.4.42",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "10.0.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.0.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "11.0.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "11.0.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/r0626f279ebf65506110a897e3a57ccd4072803ee5434b2503e070398%40%3Ccommits.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r721ab6a5fa8d45bec76714b674f5d4caed2ebfeca69ad1d6d4caae6c%40%3Cdev.hbase.apache.org%3E
lists	www.lists.apache.org/thread.html/r4727d282b5c2d951057845a46065d59f6e33132edc0a14f41c26b01e%40%3Cdev.kafka.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20210819-0006/
lists	www.lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab%40%3Cissues.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/rc26807be68748b3347decdcd03ae183622244b0b4cb09223d4b7e500%40%3Ccommits.pulsar.apache.org%3E
lists	www.lists.apache.org/thread.html/r46900f74dbb7d168aeac43bf0e7f64825376bb7eb74d31a5b33344ce%40%3Cjira.kafka.apache.org%3E
lists	www.lists.apache.org/thread.html/re850203ef8700cb826534dd4a1cb9f5b07bb8f6f973b39ff7838d3ba%40%3Cissues.hbase.apache.org%3E
lists	www.lists.apache.org/thread.html/r48a93f2bc025acd7c7e341ed3864bfdeb75f0c768d41bc247e1a1f63%40%3Cnotifications.zookeeper.apache.org%3E
oracle	www.oracle.com/security-alerts/cpujan2022.html

21 Nov 2024 06:10Current

5.4Medium risk

Vulners AI Score5.4

CVSS 25

CVSS 3.15.3

EPSS0.93778