CVE-2021-28164CWE-200CWE-551
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access…
Medium · published April 1, 2021
Patch now
High probability of exploitation
CVSS calls it medium at 5.3. It sits in the 99.7th percentile for exploit probability.
What it is
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.82371 · 99.7th percentile
- Weaknesses
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
- Published
- 2021-04-01T14:20Z
EPSS history
Timeline