$ cve CVE-2021-28164 JSON

CVE-2021-28164 EXPLOIT

5.3

MEDIUM · CVSS 3.1 · EPSS 82.4% (pctl 100)

Patch early

A public exploit exists.

Description

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Scoring

CVSS	5.3 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS	82.37% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2021-04-01
Last modified	2026-06-17

Affected (17)

Vendor	Product
eclipse	jetty
netapp	cloud manager
netapp	e-series performance analyzer
netapp	e-series santricity os controller
netapp	e-series santricity web services
netapp	element plug-in for vcenter server
netapp	santricity cloud connector
netapp	snapcenter
netapp	snapcenter plug-in
netapp	storage replication adapter for clustered data ontap
netapp	vasa provider for clustered data ontap
netapp	virtual storage console
oracle	autovue for agile product lifecycle management
oracle	banking apis
oracle	banking digital experience
oracle	communications session route manager
oracle	siebel core - automation

Public exploits

Source	Title	Date
exploit-db	Jetty 9.4.37.v20210219 - Information Disclosure	2021-10-22

References

→ the Explorer · watch your stack · NVD