CVE-2021-34429

5.3 mediumEPSS 99%

Medium (5.3). EPSS 99% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-webapp 10.0.6, 11.0.6, 9.4.43.

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-551
Published: 2021-07-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eclipse:jetty
netapp:e-series_santricity_os_controller
netapp:e-series_santricity_web_services
netapp:element_plug-in_for_vcenter_server
netapp:hci_management_node
netapp:snap_creator_framework
netapp:snapcenter_plug-in
netapp:solidfire
oracle:autovue_for_agile_product_lifecycle_management
oracle:communications_cloud_native_core_binding_support_function
oracle:communications_cloud_native_core_security_edge_protection_proxy
oracle:communications_cloud_native_core_service_communication_proxy
oracle:communications_cloud_native_core_unified_data_repository
oracle:communications_diameter_signaling_router
oracle:financial_services_crime_and_compliance_management_studio
oracle:rest_data_services
oracle:retail_eftlink
oracle:stream_analytics

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vjv5-gp2w-65vm	Maven	org.eclipse.jetty:jetty-webapp	>=9.4.37 <9.4.43	9.4.43
GHSA-vjv5-gp2w-65vm	Maven	org.eclipse.jetty:jetty-webapp	>=10.0.1 <10.0.6	10.0.6
GHSA-vjv5-gp2w-65vm	Maven	org.eclipse.jetty:jetty-webapp	>=11.0.1 <11.0.6	11.0.6

References

Check your stack JSON