CVE-2021-28164

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected

The Eclipse Foundation · Eclipse Jetty

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

82.37% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium

Published

2021-04-01

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure…
• jammy0903/-jettyCVE-2021-28164-0★ · 2024-09-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28164.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50438

Vulhub environments (1)

• vulhub/vulhub/tree/master/jetty/CVE-2021-28164

Exploit collections (2)

• jetty-cve-2021-28164.ymlchaitin/xray
• CVE-2021-28164.yamlzan8in/afrog

Security advisories

• eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
• https://security.netapp.com/advisory/ntap-20210611-0006
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• advisories/GHSA-v7ff-8wcx-gmc5

References

• CVE Record
• NVD entry