CVE-2021-28164: eclipse jetty
Vulnerability summary
CVE-2021-28164 is a medium (CVSS 5.3) vulnerability in eclipse jetty. EPSS estimates a 82.37% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 3 public exploits are recorded.
Weaponized exploit (Metasploit, 15-07-2021)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 01-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
82.37%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 82.37% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Jetty 9.4.37.v20210219 - Information Disclosure
Maturity: poc
Jetty WEB-INF File Disclosure
auxiliary/gather/jetty_web_inf_disclosure
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp11 products
- cloud_managerna
- e-series_performance_analyzerna
- e-series_santricity_os_controller≥ 11.0, ≤ 11.70.1
- e-series_santricity_web_servicesna
- element_plug-in_for_vcenter_serverna
Oracle5 products
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_apis20.1 | 21.1
- banking_digital_experience20.1 | 21.1
- communications_session_route_manager≥ 8.0.0, ≤ 8.2.4
- siebel_core_-_automation≤ 21.9
Debian1 product
- jetty9< 9.4.39-1
Eclipse1 product
- jettyEOL9.4.37:20210219 | 9.4.38:20210224
Org.eclipse.jetty1 product
- jetty-webapp≥ 9.4.37, < 9.4.39
The eclipse foundation1 product
- eclipse jetty≥ 9.4.37.v20210219, < unspecified | ≥ unspecified, ≤ 9.4.38.v20210224
Ubuntu1 product
- equinox-bundlesAll versions (No fix recorded)
7 vendors · 21 products
References
50 links- github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5X Refsource CONFIRMREPORTWEBMitigationThird Party Advisory
Show all 50 references
- packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
