auxiliary/gather/jetty_web_inf_disclosure

functional

Jetty WEB-INF File Disclosure

view exploit source metasploittype auxiliarypublished 2021-07-15catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2021-34429US	medium5.3OT high	99.3% (100th)	Exploit	2021-07-15
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or byp…
CVE-2021-28164US	medium5.3OT high	82.4% (100th)	Exploit	2021-04-01
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources withi…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.