S4E just found a high top 10 tcp port service scan
medium·Product Based Web Vulnerabilities·Updated Jan 8, 2024

CVE-2021-34429 Scanner

CVE-2021-34429 scanner - Authorization Bypass vulnerability in Eclipse Jetty

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, ipv4, subdomain
CostFree
0
Times Used
by S4E users
0
Assets Scanned
domains & IPs
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2021-34429
5.3
CVSSmedium
Exploitable remotely over the internet · no authentication required.

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Eclipse Jettyby The Eclipse Foundation
AFFECTED< unspecified→SAFE ✓≥ unspecified
Updated Aug 19, 2026View on NVD →
Detail

Eclipse Jetty is a high-performance web server and Java Servlet container. It is widely used for building and deploying web applications, including large-scale enterprise systems, web services, and mobile applications. Its lightweight and flexible architecture, combined with its support for multiple protocols and APIs, make it a popular choice for developers around the world.

The CVE-2021-34429 vulnerability detected in Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 is a serious security concern. This vulnerability enables attackers to craft URIs using encoded characters to access the content of the WEB-INF directory, which is typically protected by default security constraints. This type of attack can lead to the unauthorized disclosure of sensitive data, such as user credentials, application configurations, and other confidential information.

When exploited, CVE-2021-34429 can have devastating consequences for both individuals and large organizations. Attackers can gain access to sensitive data and use it for identity theft, financial fraud, or other criminal activities. In some cases, they may also be able to compromise the integrity of the entire application, including its core functionality and data storage.

With the pro features of the s4e.io platform, individuals and organizations can easily and quickly learn about vulnerabilities in their digital assets. This platform provides advanced scanning tools, real-time alerts, and expert guidance to help users protect their systems and data from the latest threats. By investing in comprehensive security solutions, users can take a proactive stance against cybercrime and safeguard their most valuable assets.

 

REFERENCES

Solution Advice

To protect against this vulnerability, users of Eclipse Jetty should take the following precautions:

  • Upgrade to the latest version of the software as soon as possible.
  • Disable the ability to access the WEB-INF directory from untrusted sources.
  • Implement additional security controls, such as firewall rules and access controls, to limit access to sensitive data.
  • Monitor systems and applications for signs of suspicious activity, such as unusual network traffic or unauthorized access attempts.
  • Educate users on safe computing practices, such as not clicking on suspicious links or downloading unknown software from the internet.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →
Similar Tools
critical
CVE-2020-8772 Scanner
→high
CVE-2021-42192 Scanner
→critical
CVE-2023-6018 Scanner
→critical
CVE-2020-26919 Scanner
→critical
CVE-2019-7238 Scanner
→high
CVE-2020-10973 Scanner
→critical
CVE-2022-34045 Scanner
→high
CVE-2022-0824 Scanner
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.