NetSight
IP …
medium5.3Public exploit code

CVE-2021-28164

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access prot…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected products

VendorProductAffected versions
EclipseJetty
Versions 9.4.37, 9.4.38
NetappCloud Manager
All versions
NetappE-Series Performance Analyzer
All versions
NetappE-Series Santricity Os Controller
from 11.0 through 11.70.1
NetappE-Series Santricity Web Services
All versions
NetappElement Plug-In For Vcenter Server
All versions
NetappSantricity Cloud Connector
All versions
NetappSnapcenter
All versions
NetappSnapcenter Plug-In
All versions
NetappStorage Replication Adapter For Clustered Data Ontap
from 9.6
NetappVasa Provider For Clustered Data Ontap
from 9.6
NetappVirtual Storage Console
from 9.6

Weakness classification

CWE-200CWE-551

References