According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.39, 10.0.x prior to 10.0.2 or 11.0.x prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities:

- An issue where CPU usage can reach 100% with a large invalid TLS frame. (CVE-2021-28165)

- A issue with permitting access to protected resources within the WEB-INF directory when accessed with encoded paths. (CVE-2021-28164)

- An issue when a symlinked webapps directory is used, the contents of the webapps directory is deployed as a static webapp. (CVE-2021-28163)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a
    webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp,
    inadvertently serving the webapps themselves and anything else that might be in that directory.
    (CVE-2021-28163)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2005-1 advisory.

  - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a     webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp,     inadvertently serving the webapps themselves and anything else that might be in that directory.
    (CVE-2021-28163)

  - In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with     URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For     example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive     information regarding the implementation of a web application. (CVE-2021-28164)

  - In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can     reach 100% upon receiving a large invalid TLS frame. (CVE-2021-28165)

  - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the     ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For     example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal     sensitive information regarding the implementation of a web application. (CVE-2021-28169)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1551 advisory.

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - jenkins: lack of type validation in agent related REST API (CVE-2021-21639)

  - jenkins: view name validation bypass (CVE-2021-21640)

  - jetty: Symlink directory exposes webapp directory contents (CVE-2021-28163)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2005-1 advisory.

    Update to version 9.4.42.v20210604

    - Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path     to access protected resources within the WEB-INF directory
    - Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length > 17408
    - Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
    - Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a     webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp,     inadvertently serving the webapps themselves and anything else that might be in that directory.
    (CVE-2021-28163)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1551 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.7.11. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:1550

    Security Fix(es):

    * golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

    * golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

    * jetty: Symlink directory exposes webapp directory contents (CVE-2021-28163)

    * jetty: Resource exhaustion when receiving an invalid large TLS frame (CVE-2021-28165)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.7 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1509 advisory.

    Jetty is a 100% Java HTTP Server and Servlet Container.

    The following packages have been upgraded to a later upstream version: rh-eclipse-jetty (9.4.40).

    Security Fix(es):

    * jetty: Symlink directory exposes webapp directory contents (CVE-2021-28163)

    * jetty: Ambiguous paths can access WEB-INF (CVE-2021-28164)

    * jetty: Resource exhaustion when receiving an invalid large TLS frame (CVE-2021-28165)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
112993	Jetty < 9.4.39 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	high
112994	Jetty 10.0.x < 10.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	high
112995	Jetty 11.0.x < 11.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	high
416191	SCA: security update for org.eclipse.jetty:jetty-deploy (GHSA-j6qj-j888-vvgq)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	low
416191	SCA: security update for org.eclipse.jetty:jetty-deploy (GHSA-j6qj-j888-vvgq)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	low
151741	openSUSE 15 Security Update : jetty-minimal (openSUSE-SU-2021:2005-1)	Nessus	SuSE Local Security Checks	7/16/2021	1/20/2022	medium
312553	RHCOS 4 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)	Nessus	Red Hat Local Security Checks	5/6/2026	5/6/2026	medium
150895	SUSE SLED15: jetty-http / jetty-io / jetty-security / jetty-server / etc (SUSE-SU-2021:2005-1)	Nessus	SuSE Local Security Checks	6/21/2021	6/25/2026	medium
223759	Linux Distros Unpatched Vulnerability : CVE-2021-28163	Nessus	Misc.	3/4/2025	9/2/2026	low
149793	RHEL 7 / 8 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)	Nessus	Red Hat Local Security Checks	5/20/2021	11/8/2024	medium
149318	RHEL 7 : rh-eclipse-jetty (RHSA-2021:1509)	Nessus	Red Hat Local Security Checks	5/6/2021	11/7/2024	medium

Detections

Analytics

Plugins Search

high

high

high

low

low

medium

medium

medium

low

medium

medium