CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2021-28164
Medium (5.3). EPSS 82% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-webapp 9.4.39.
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Severity
- EPSS
- 82% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-200, CWE-551
- Published
- Modified
- Record from
- the NVD, synced
Affected
- eclipse:jetty
- netapp:cloud_manager
- netapp:e-series_performance_analyzer
- netapp:e-series_santricity_os_controller
- netapp:e-series_santricity_web_services
- netapp:element_plug-in_for_vcenter_server
- netapp:santricity_cloud_connector
- netapp:snapcenter
- netapp:snapcenter_plug-in
- netapp:storage_replication_adapter_for_clustered_data_ontap
- netapp:vasa_provider_for_clustered_data_ontap
- netapp:virtual_storage_console
- oracle:autovue_for_agile_product_lifecycle_management
- oracle:banking_apis
- oracle:banking_digital_experience
- oracle:communications_session_route_manager
- oracle:siebel_core_-_automation
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v7ff-8wcx-gmc5 | Maven | org.eclipse.jetty:jetty-webapp | >=9.4.37 <9.4.39 | 9.4.39 |
References
- http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
- https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3E