CVE-2021-28164
Medium
Description
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Eclipse Jetty
PublishedApr 1, 2021
First seenApr 1, 2021
Weakness typeCWE-200Sensitive information exposureCWE-551CWE-551
How to fix
Update
- org.eclipse.jetty:jetty-webapp9.4.39 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.4.37, 9.4.38 | — |
| netapp cloud_manager | No range specified | — |
| netapp e-series_performance_analyzer | No range specified | — |
| netapp e-series_santricity_os_controller | 11.0 ≤ v ≤ 11.70.1 | — |
| netapp e-series_santricity_web_services | No range specified | — |
| netapp element_plug-in_for_vcenter_server | No range specified | — |
| netapp santricity_cloud_connector | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp snapcenter_plug-in | No range specified | — |
| netapp storage_replication_adapter_for_clustered_data_ontap | 9.6 ≤ v | — |
| netapp vasa_provider_for_clustered_data_ontap | 9.6 ≤ v | — |
| netapp virtual_storage_console | 9.6 ≤ v | — |
| oracle autovue_for_agile_product_lifecycle_management | 21.0.2 | — |
| oracle banking_apis | 20.1, 21.1 | — |
| oracle banking_digital_experience | 20.1, 21.1 | — |
| oracle communications_session_route_manager | 8.0.0 ≤ v ≤ 8.2.4 | — |
| oracle siebel_core_-_automation | v ≤ 21.9 | — |
| org.eclipse.jetty:jetty-webappMaven | 9.4.37 ≤ v < 9.4.39 | 9.4.39 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.