CVE-2021-28164: Eclipse Jetty

Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days.

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected products

• Eclipse Jetty: version 9.4.37 only; version 9.4.38 only
• Netapp Cloud Manager: affected versions not specified
• Netapp E-Series Performance Analyzer: affected versions not specified
• Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.1
• Netapp E-Series Santricity Web Services: affected versions not specified
• Netapp Element Plug-In For vCenter Server: affected versions not specified
• Netapp Santricity Cloud Connector: affected versions not specified
• Netapp Snapcenter: affected versions not specified
• Netapp Snapcenter Plug-In: affected versions not specified
• Netapp Storage Replication Adapter For Clustered Data Ontap: from 9.6
• Netapp Vasa Provider For Clustered Data Ontap: from 9.6
• Netapp Virtual Storage Console: from 9.6
• Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
• Oracle Banking Apis: version 20.1 only; version 21.1 only
• Oracle Banking Digital Experience: version 20.1 only; version 21.1 only
• Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.4
• Oracle Siebel Core - Automation: up to and including 21.9

Published 2021-04-01. Last modified 2026-06-17.