CVE-2021-28164

Aliases:GHSA-v7ff-8wcx-gmc5
Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 01 Apr 2021, 14:20
Last modified:03 Aug 2024, 21:40

Vulnerability Summary

Overall Risk (default)
high
50/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
93.48% CRITICAL
93% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

01 Apr 2021, 14:20
Published
Vulnerability first disclosed
03 Aug 2024, 21:40
Last Modified
Vulnerability information updated

Description

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 93.48%• Percentile: 100%

Techniques & Countermeasures

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

  • CWE-551•Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

    If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

Affected Systems

  • eclipse•jetty

    9.4.37:20210219 | 9.4.38:20210224

  • org.eclipse.jetty•jetty-webapp

    ≥ 9.4.37, < 9.4.39

  • netapp•cloud_manager

    na

  • netapp•e-series_performance_analyzer

    na

  • netapp•e-series_santricity_os_controller

    ≥ 11.0, ≤ 11.70.1

  • netapp•e-series_santricity_web_services

    na

  • netapp•element_plug-in_for_vcenter_server

    na

  • netapp•santricity_cloud_connector

    na

  • netapp•snapcenter

    na

  • netapp•snapcenter_plug-in

    na

  • netapp•storage_replication_adapter_for_clustered_data_ontap

    ≥ 9.6

  • netapp•vasa_provider_for_clustered_data_ontap

    ≥ 9.6

  • netapp•virtual_storage_console

    ≥ 9.6

  • oracle•autovue_for_agile_product_lifecycle_management

    21.0.2

  • oracle•banking_apis

    20.1 | 21.1

  • oracle•banking_digital_experience

    20.1 | 21.1

  • oracle•communications_session_route_manager

    ≥ 8.0.0, ≤ 8.2.4

  • oracle•siebel_core_-_automation

    ≤ 21.9

  • the eclipse foundation•eclipse jetty

    ≥ 9.4.37.v20210219, < unspecified | ≥ unspecified, ≤ 9.4.38.v20210224

References (47)