what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from cangqingzhe

Jetty WEB-INF File Disclosure

Posted Aug 31, 2024

Authored by h00die, Mayank Deshmukh, cangqingzhe, charlesk40, lachlan roberts | Site metasploit.com

Jetty suffers from a vulnerability where certain encoded URIs and ambiguous paths can access protected files in the WEB-INF folder. Versions effected are: 9.4.37.v20210219, 9.4.38.v20210224 and 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5. Exploitation can obtain any file in the WEB-INF folder, but web.xml is most likely to have information of value.

tags | exploit, web

advisories | CVE-2021-28164, CVE-2021-34429

SHA-256 | 8dfcee78eebf17abc7fd9c39192937639d93c646932d8c726dffcbafbedbf39b

Download | Favorite | View