Jetty 10.0.x < 10.0.3 Multiple Vulnerabilities

2021-10-0400:00:00

www.tenable.com

jetty

vulnerabilities

session invalidation

protected resources

remote web server

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.006

Percentile

78.9%

JSON

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities:

An issue with failure to invalidate sessions after an exception in the SessionListener#sessionDestroyed() method. (CVE-2021-34428)
A issue with permitting access to protected resources within the WEB-INF directory when accessed with doubly encoded paths. (CVE-2021-28169)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.