CVE-2021-28164

Published: Apr 1, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected (20)

Products: Eclipse: Jetty · Netapp: Cloud Manager, E Series Performance Analyzer, E Series Santricity Os Controller, E Series Santricity Web Services, Element Plug In For Vcenter Server, Santricity Cloud Connector, Snapcenter, Snapcenter Plug In, Storage Replication Adapter For Clustered Data Ontap, Vasa Provider For Clustered Data Ontap, Virtual Storage Console · Oracle: Autovue For Agile Product Lifecycle Management, Banking Apis, Banking Digital Experience, Communications Session Route Manager, Siebel Core Automation

1 product

11 products

E Series Performance Analyzer

E Series Santricity Os Controller

E Series Santricity Web Services

Element Plug In For Vcenter Server

Santricity Cloud Connector

Snapcenter

Snapcenter Plug In

Storage Replication Adapter For Clustered Data Ontap

Vasa Provider For Clustered Data Ontap

Virtual Storage Console

Oracle

5 products

Autovue For Agile Product Lifecycle Management

Banking Apis

Banking Digital Experience

Communications Session Route Manager

Siebel Core Automation

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Eclipse Jetty	Version 9.4.37 20210219
Eclipse Jetty	Version 9.4.38 20210224

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Manager	All versions
Netapp E Series Performance Analyzer	All versions
Netapp E Series Santricity Os Controller	From 11.0 to 11.70.1
Netapp E Series Santricity Web Services	All versions
Netapp Element Plug In For Vcenter Server	All versions
Netapp Santricity Cloud Connector	All versions
Netapp Snapcenter	All versions
Netapp Snapcenter Plug In	All versions
Netapp Storage Replication Adapter For Clustered Data Ontap	From 9.6
Netapp Vasa Provider For Clustered Data Ontap	From 9.6
Netapp Virtual Storage Console	From 9.6

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Oracle Autovue For Agile Product Lifecycle Management	Version 21.0.2
Oracle Banking Apis	Version 20.1
Oracle Banking Apis	Version 21.1
Oracle Banking Digital Experience	Version 20.1
Oracle Banking Digital Experience	Version 21.1
Oracle Communications Session Route Manager	From 8.0.0 to 8.2.4
Oracle Siebel Core Automation	Up to 21.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-551

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

References (50)

http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html

Source: emo@eclipse.org

ExploitThird Party AdvisoryVDB Entry

https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5

Source: emo@eclipse.org

MitigationThird Party Advisory

https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r3c55b0baa4dc38958ae147b2f216e212605f1071297f845e14477d36%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82%40%3Cdev.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r8e6c116628c1277c3cf132012a66c46a0863fa2a3037c0707d4640d4%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rcea249eb7a0d243f21696e4985de33f3780399bf7b31ea1f6d489b8b%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E

Source: emo@eclipse.org

https://security.netapp.com/advisory/ntap-20210611-0006/

Source: emo@eclipse.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: emo@eclipse.org

Not ApplicableThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: emo@eclipse.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: emo@eclipse.org

PatchThird Party Advisory

http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html