CVEvulnerability

CVE-2021-28164

5.3 MEDIUM Published 2021-04-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-04-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-551

Description

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected configurations

• eclipse jetty 9.4.37 • eclipse jetty 9.4.38 • netapp cloud manager • netapp e-series performance analyzer • netapp e-series santricity os controller (>= 11.0 <= 11.70.1) • netapp e-series santricity web services • netapp element plug-in for vcenter server • netapp santricity cloud connector • netapp snapcenter • netapp snapcenter plug-in • netapp storage replication adapter for clustered data ontap (>= 9.6) • netapp vasa provider for clustered data ontap (>= 9.6) • netapp virtual storage console (>= 9.6) • oracle autovue for agile product lifecycle management 21.0.2 • oracle banking apis 20.1 • oracle banking apis 21.1 • oracle banking digital experience 20.1 • oracle banking digital experience 21.1 • oracle communications session route manager (>= 8.0.0 <= 8.2.4) • oracle siebel core - automation (<= 21.9)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization weakness

References