For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jetty: Timing channel attack in util/security/Password.java (CVE-2017-9735)

  - jetty: crafted URIs allow bypassing security constraints (CVE-2021-34429)

  - In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an     intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the     DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException     which includes the full path to the base resource directory that the DefaultServlet and/or webapp is     using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException     message is included in the error response, revealing the full server path to the requesting system.
    (CVE-2018-12536)

  - In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a     request containing multiple Accept headers with a large number of quality (i.e. q) parameters, the     server may enter a denial of service (DoS) state due to high CPU usage processing those quality values,     resulting in minutes of CPU time exhausted processing those quality values. (CVE-2020-27223)

  - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a     webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp,     inadvertently serving the webapps themselves and anything else that might be in that directory.
    (CVE-2021-28163)

  - In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with     URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For     example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive     information regarding the implementation of a web application. (CVE-2021-28164)

  - In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can     reach 100% upon receiving a large invalid TLS frame. (CVE-2021-28165)

  - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the     ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For     example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal     sensitive information regarding the implementation of a web application. (CVE-2021-28169)

  - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the     SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID     manager. On deployments with clustered sessions and multiple contexts this can result in a session not     being invalidated. This can result in an application used on a shared computer being left logged in.
    (CVE-2021-34428)

  - Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the     CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a     request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet     will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command     prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the     user contains a quotation mark followed by a space, the resulting command line will contain multiple     tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
    (CVE-2023-36479)

  - Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and     12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This     is more permissive than allowed by the RFC and other servers routinely reject such requests with 400     responses. There is no known exploit scenario, but it is conceivable that request smuggling could result     if jetty is used in combination with a server that does not close the connection after sending such a 400     response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no     workaround as there is no known exploit scenario. (CVE-2023-40167)

  - Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15     are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested     `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current     request will still treat the user as authenticated. The authentication is then cleared from the session     and subsequent requests will not be treated as authenticated. So a request on a previously authenticated     session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This     impacts usages of the jetty-openid which have configured a nested `LoginService` and where that     `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and     11.0.16 have a patch for this issue. (CVE-2023-41900)

  - Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP     congested will be leaked when it times out. An attacker can cause many connections to end up in this     state, and the server may run out of file descriptors, eventually causing the server to stop accepting new     connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
    (CVE-2024-22201)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the July 2023 CPU advisory, including:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Xerces2 Java)). The supported version that is affected is     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Process Management Suite. (CVE-2022-23437)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Studio (jQueryUI)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Process Management Suite. Successful attacks require human interaction from a person     other than the attacker and while the vulnerability is in Oracle Business Process Management Suite,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business     Process Management Suite accessible data as well as unauthorized read access to a subset of Oracle     Business Process Management Suite accessible data. (CVE-2021-41184)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Installer (Apache Ant)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle     Business Process Management Suite executes to compromise Oracle Business Process Management Suite.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Process Management Suite. (CVE-2021-36374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Jetty installed on the remote host has a flaw which allows bypass of security constraints and access protected resources. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2838-1 advisory.

  - For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some     encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.
    This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. (CVE-2021-34429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2838-1 advisory.

  - For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some     encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.
    This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. (CVE-2021-34429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196483	RHEL 7 : jetty (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
178625	Oracle Business Process Management Suite (Jul 2023 CPU)	Nessus	Misc.	medium
112989	Jetty 11.0.x < 11.0.6 Information Disclosure	Web App Scanning	Component Vulnerability	medium
112988	Jetty 10.0.x < 10.0.6 Information Disclosure	Web App Scanning	Component Vulnerability	medium
112987	Jetty 9.4.37 < 9.4.43 Information Disclosure	Web App Scanning	Component Vulnerability	medium
152849	openSUSE 15 Security Update : jetty-minimal (openSUSE-SU-2021:2838-1)	Nessus	SuSE Local Security Checks	medium
152847	SUSE SLED15 / SLES15 Security Update : jetty-minimal (SUSE-SU-2021:2838-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-34429

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium