Description
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Remediation
References
Related Vulnerabilities
MySQL CVE-2017-3467 Vulnerability (CVE-2017-3467)
WordPress Plugin Easy Modal Multiple SQL Injection Vulnerabilities (2.0.17)
WordPress Plugin Advanced Access Manager Multiple Vulnerabilities (6.6.1)
WordPress Plugin WP Gravity Forms Zendesk Cross-Site Scripting (1.0.7)
Magento Incorrect Authorization Vulnerability (CVE-2021-28567)