{"cve":"CVE-2021-28169","nvd":{"published":"2021-06-09T02:15:06.853","modified":"2026-06-17T03:45:56.683","status":"Modified","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-200"],"references":["https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq","https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140%40%3Cjira.kafka.apache.org%3E"],"products":["debian:debian_linux","eclipse:jetty","netapp:active_iq_unified_manager","netapp:hci","netapp:management_services_for_element_software","netapp:snap_creator_framework","oracle:communications_cloud_native_core_policy","oracle:rest_data_services"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-28169","score":0.7848,"percentile":0.99584,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gwcr-j4wh-j3cq","url":"https://osv.dev/vulnerability/GHSA-gwcr-j4wh-j3cq","summary":"Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability","modified":"2026-09-10T03:49:06.238447777Z","packages":[{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-servlets","purl":"pkg:maven/org.eclipse.jetty/jetty-servlets","ranges":["<9.4.41"],"fixed":["9.4.41"]},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-servlets","purl":"pkg:maven/org.eclipse.jetty/jetty-servlets","ranges":[">=10.0.0 <10.0.3"],"fixed":["10.0.3"]},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-servlets","purl":"pkg:maven/org.eclipse.jetty/jetty-servlets","ranges":[">=11.0.0 <11.0.3"],"fixed":["11.0.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}