Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-28164

CWE-200 — Information ExposureCWE-551CWE-863 — Incorrect Authorization13 documents9 sources
Severity
5.3MEDIUM
EPSS
93.5%
top 0.18%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
11
THE Eclipse Foundation Eclipse JettyNetapp E-series Santricity OS ControllerOracle Communications Session Route Manager+8 more
Timeline
PublishedApr 1
Latest updateJan 15

Description

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages13 packages

▶Mavenorg.eclipse.jetty:jetty-webapp9.4.37 — 9.4.39
▶CVEListV5the_eclipse_foundation/eclipse_jetty9.4.37 — unspecified+5
▶NVDeclipse/jetty9.4.37, 9.4.38+1
▶Debianjetty9< 9.4.39-1+3

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
Encoded URIs can access WEB-INF directory in Eclipse Jetty↗2021-07-19
▶
OSV
Authorization Before Parsing and Canonicalization in jetty↗2021-04-06
▶
GHSA
Authorization Before Parsing and Canonicalization in jetty↗2021-04-06
▶
OSV
CVE-2021-28164: In Eclipse Jetty 9↗2021-04-01
▶
CVEList
CVE-2021-28164: In Eclipse Jetty 9↗2021-04-01
▶

💥Exploits & PoCs

3
Exploit-DB
Jetty 9.4.37.v20210219 - Information Disclosure↗2021-10-22
▶
Nuclei
Eclipse Jetty - Information Disclosure
▶
Nuclei
Eclipse Jetty - Information Disclosure
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Framework (Apache Ignite) — CVE-2021-28164↗2022-01-15
▶
Red Hat
jetty: crafted URIs allow bypassing security constraints↗2021-07-15
▶
Red Hat
jetty: Ambiguous paths can access WEB-INF↗2021-04-01
▶
Debian
CVE-2021-28164: jetty9 - In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mo...↗2021
▶