According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities:

 - An issue with failure to invalidate sessions after an exception in the SessionListener#sessionDestroyed() method. (CVE-2021-34428)

 - A issue with permitting access to protected resources within the WEB-INF directory when accessed with doubly encoded paths. (CVE-2021-28169)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3758 advisory.

  - coreos-installer: restrict access permissions on /boot/ignition{,/config.ign} (CVE-2021-3917)

  - jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the     WEB-INF directory (CVE-2021-28169)

  - golang: archive/zip: malformed archive may cause panic or memory exhaustion (CVE-2021-33196)

  - jetty: SessionListener can prevent a session from being invalidated breaking logout (CVE-2021-34428)

  - openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action     (CVE-2021-36980)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4949 advisory.

  - In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is     vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet     or ResourceHandler that is configured for showing a Listing of directory contents. (CVE-2019-10241)

  - In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server     running on any OS and Jetty version combination will reveal the configured fully qualified directory base     resource location on the output of the 404 error for not finding a Context that matches the requested     path. The default server behavior on jetty-distribution and jetty-home will include at the end of the     Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various     configured contexts as HTML for users to click through to. This produced HTML includes output that     contains the configured fully qualified directory base resource location for each context.
    (CVE-2019-10247)

  - In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1     thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on     that system. A collocated user can observe the process of creating a temporary sub directory in the shared     temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins     the race then they will have read and write permission to the subdirectory used to unpack web     applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of     this temporary directory, this can lead to a local privilege escalation vulnerability. (CVE-2020-27216)

  - In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a     request containing multiple Accept headers with a large number of quality (i.e. q) parameters, the     server may enter a denial of service (DoS) state due to high CPU usage processing those quality values,     resulting in minutes of CPU time exhausted processing those quality values. (CVE-2020-27223)

  - The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the     bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.
    (CVE-2020-28169)

  - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the     SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID     manager. On deployments with clustered sessions and multiple contexts this can result in a session not     being invalidated. This can result in an application used on a shared computer being left logged in.
    (CVE-2021-34428)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
112990	Jetty < 9.4.41 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	medium
112991	Jetty 10.0.x < 10.0.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	medium
112992	Jetty 11.0.x < 11.0.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	medium
165134	RHEL 7 / 8 : OpenShift Container Platform 4.9.0 (RHSA-2021:3758)	Nessus	Red Hat Local Security Checks	9/15/2022	4/28/2024	medium
152224	Debian DSA-4949-1 : jetty9 - security update	Nessus	Debian Local Security Checks	8/5/2021	12/6/2023	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical