Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Eclipse Jetty versions allow unauthorized access to sensitive files

CVE-2021-28169 · published 5 years ago
Summary

Versions of Eclipse Jetty before 9.4.41, 10.0.3, and 11.0.3 have a security risk. An attacker can use a special request to access sensitive files on your server, potentially revealing information about how your web application works. Update to the latest version of Eclipse Jetty to fix this issue.

What to do
  • Update eclipse org.eclipse.jetty:jetty-servlets to version 9.4.41.
  • Update eclipse org.eclipse.jetty:jetty-servlets to version 10.0.3.
  • Update eclipse org.eclipse.jetty:jetty-servlets to version 11.0.3.
  • Update oracle rest_data_services to version 21.3 or later.
Affected software
Ecosystem VendorProductAffected versions
maven eclipse org.eclipse.jetty:jetty-servlets <= 9.4.40
>= 10.0.0, <= 10.0.2
>= 11.0.0, <= 11.0.2
Fix: upgrade to 9.4.41
– eclipse jetty < 9.4.41
>= 10.0.0, < 10.0.3
>= 11.0.0, < 11.0.3
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
10.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
– oracle communications_cloud_native_core_policy 1.14.0
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
– oracle rest_data_services < 21.3
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*
– netapp active_iq_unified_manager All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
– netapp hci All versions
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
– netapp management_services_for_element_software All versions
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
– netapp snap_creator_framework All versions
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
Original advisory text
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. F...
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
78% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published9 Jun 2021
Updated15 Jun 2026
First seen6 Mar 2026
Sources
GHSA-gwcr-j4wh-j3cq · GHSA
CVE-2021-28169 · NVD
Track software like this
Free during beta