CyberRota Analysis
AI-GeneratedEclipse Jetty is vulnerable in scenarios where web applications depend on resolved paths, as it may return an unresolved path that could lead to unexpected behavior or security issues. Although Jetty itself does not serve the sensitive file due to its alias checker, applications that process these unresolved paths could inadvertently expose sensitive information or misroute requests. Organizations using Jetty in conjunction with web applications that handle URI paths should prioritize addressing this issue to ensure proper path resolution and maintain security integrity.
Original NVD Description
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
Related CVEs
Other vulnerabilities affecting the same vendor(s)