CVE-2021-28164
MEDIUM 5.3EPSS 82.4%
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- CVSS v3.1
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v3.1
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v3.1
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v2.0
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 82.37% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- medium
- Published
- 2021-04-01
- Updated
- 2024-08-03
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure…
- jammy0903/-jettyCVE-2021-28164-0★ · 2024-09-23
Nuclei templates (1)
ExploitDB entries (1)
Vulhub environments (1)
Exploit collections (2)
- chaitin/xray/blob/master/pocs/jetty-cve-2021-28164.yml
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2021/CVE-2021-28164.yaml