CVEvulnerability

CVE-2021-34429

5.3 MEDIUM Published 2021-07-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-07-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-551

Description

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Affected configurations

• eclipse jetty (>= 9.4.37 < 9.4.43) • eclipse jetty (>= 10.0.1 < 10.0.6) • eclipse jetty (>= 11.0.1 < 11.0.6) • netapp e-series santricity os controller (>= 11.0 <= 11.70.1) • netapp e-series santricity web services • netapp element plug-in for vcenter server • netapp hci management node • netapp snap creator framework • netapp snapcenter plug-in • netapp solidfire • oracle autovue for agile product lifecycle management 21.0.2 • oracle communications cloud native core binding support function 1.10.0 • oracle communications cloud native core security edge protection proxy 1.5.0 • oracle communications cloud native core service communication proxy 1.14.0 • oracle communications cloud native core unified data repository 1.14.0 • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.5.0.2) • oracle financial services crime and compliance management studio 8.0.8.2.0 • oracle financial services crime and compliance management studio 8.0.8.3.0 • oracle rest data services (< 22.1.1) • oracle retail eftlink 20.0.1 • oracle stream analytics (< 19.1.0.0.6.4) • oracle stream analytics 19c

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization weakness

References