CVE-2011-4404 CVE-2011-4404

漏洞描述

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.

影响产品

eclipseJetty查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

jetty.codehaus.orghttp://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/handler/ResourceHandler.html↗www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2011-0014.html↗jetty.codehaus.orghttp://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/servlet/DefaultServlet.html↗www.securitytracker.comhttp://www.securitytracker.com/id?1026341↗

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
snoop_servlet Snoop Servlet - Information Disclosure Apache Tomcat Jetty Resin+2	低危	—	—	PoCEXP	2024/07/11
CVE-2021-34429 Eclipse Jetty - Information Disclosure Jetty	中危	5.3	93.8%	PoCEXP	2021/07/16
jetty_showcontexts_enable Jetty showContexts Enable in DefaultHandler Jetty	低危	—	—	PoCEXP	2021/06/28
CVE-2021-28169 Eclipse Jetty ConcatServlet - Information Disclosure Jetty	中危	5.3	92.4%	PoCEXP	2021/06/09
CVE-2021-28164 Eclipse Jetty - Information Disclosure Jetty	中危	5.3	93.5%	PoCEXP	2021/04/01

利用情报状态

漏洞描述

影响产品

修复建议

参考链接

同产品关联漏洞