| Description: | Summary:
Various application or web servers / products are prone to an
information disclosure vulnerability.
Vulnerability Insight:
The servlet specification prohibits servlet containers from
serving resources in the '/WEB-INF' and '/META-INF' directories of a web application archive
directly to clients.
This means that URLs like:
http://example.com/WEB-INF/web.xml
will return an error message, rather than the contents of the deployment descriptor.
However, some application or web servers / products are prone to a vulnerability that exposes this
information if the client requests a URL like this instead:
http://example.com/%2557EB-INF/web.xml
(note the doubled encoding '%2557' of 'W').
Vulnerability Impact:
Based on the information provided in this file an attacker might
be able to gather additional info and / or sensitive data about the application / the application
/ web server.
Affected Software/OS:
The following products are known to be affected:
- Eclipse Jetty versions before 9.4.41, 10.0.3 and 11.0.3
Other products might be affected as well.
Solution:
The following vendor fixes are known:
- Update Eclipse Jetty to version 9.4.41, 10.0.3, 11.0.3 or later.
For other products please contact the vendor for more information on possible fixes.
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
