CVE-2021-28164

PoC —

CVSS 3.1

5.3 medium

EPSS

82%p100

Published

Apr 1, 2021 (Apr 1, 2021)

Modified

Jun 17, 2026

Description

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Vendors: eclipse netapp oracle
Products: jetty, cloud manager, e-series performance analyzer, e-series santricity os controller, e-series santricity web services, element plug-in for vcenter server, santricity cloud connector, snapcenter, snapcenter plug-in, storage replication adapter for clustered data ontap, vasa provider for clustered data ontap, virtual storage console
Weakness: CWE-200, CWE-551
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (82.4%)

In the news0 stories

No ingested article mentions this CVE yet.