| Description: | Summary:
Various application or web servers / products are prone to an
information disclosure vulnerability.
Vulnerability Insight:
The servlet specification prohibits servlet containers from
serving resources in the '/WEB-INF' and '/META-INF' directories of a web application archive
directly to clients.
This means that URLs like:
http://example.com/WEB-INF/web.xml
will return an error message, rather than the contents of the deployment descriptor.
However, some application or web servers / products are prone to a vulnerability that exposes this
information if the client requests a URL like this instead:
http://example.com/%2e/WEB-INF/web.xml
Vulnerability Impact:
Based on the information provided in this file an attacker might
be able to gather additional info and / or sensitive data about the application / the application
/ web server.
Affected Software/OS:
The following products are known to be affected:
- Atlassian Jira Server and Jira Data Center
- Eclipse Jetty versions 9.4.37.v20210219 and 9.4.38.v2021022
Other products might be affected as well.
Solution:
The following vendor fixes are known:
- Update Atlassian Jira Server to version 8.5.11, 8.13.3, 8.15.0 or later.
- Update Eclipse Jetty to version 9.4.43, 10.0.6, 11.0.6 or later.
For other products please contact the vendor for more information on possible fixes.
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
