CVE-2021-34429 in eclipse jetty
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Affected software: eclipse jetty, netapp e-series santricity os controller, netapp e-series santricity web services, netapp element plug-in for vcenter server, netapp hci management node, netapp snap creator framework, netapp snapcenter plug-in, netapp solidfire, oracle autovue for agile product lifecycle management, oracle communications cloud native core binding support function
Scores
- CVSS: 5.3 (medium)
- EPSS: 99.33% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2021-07-15
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.