CVE-2021-34429

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.37 through 9.4.42 Eclipse Jetty versions 10.0.1 through 10.0.5 Eclipse Jetty versions 11.0.1 through 11.0.5

Description The issue allows an attacker to craft URIs using encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is related to improper authorization in the Jetty servlet container, which can be exploited by a remote attacker to gain access to confidential data.

Recommendations For Eclipse Jetty versions 9.4.37 through 9.4.42, update to a version outside of this range to resolve the issue. For Eclipse Jetty versions 10.0.1 through 10.0.5, update to a version outside of this range to resolve the issue. For Eclipse Jetty versions 11.0.1 through 11.0.5, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the WEB-INF directory to minimize the risk of exploitation.