CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-28164

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.934

EPSS Ranking 99.8%

CVSS Severity

CVSS v3 Score 5.3

CVSS v2 Score 5.0

References

Products affected by CVE-2021-28164

Eclipse » Jetty » Version: 9.4.37

cpe:2.3:a:eclipse:jetty:9.4.37
Eclipse » Jetty » Version: 9.4.38

cpe:2.3:a:eclipse:jetty:9.4.38
Netapp » Cloud Manager » Version: N/A

cpe:2.3:a:netapp:cloud_manager:-
Netapp » E-Series Performance Analyzer » Version: N/A

cpe:2.3:a:netapp:e-series_performance_analyzer:-
Netapp » E-Series Santricity Os Controller » Version: 11.0

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0
Netapp » E-Series Santricity Os Controller » Version: 11.0.0

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.0.0
Netapp » E-Series Santricity Os Controller » Version: 11.20

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.20
Netapp » E-Series Santricity Os Controller » Version: 11.25

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.25
Netapp » E-Series Santricity Os Controller » Version: 11.30

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.30
Netapp » E-Series Santricity Os Controller » Version: 11.30.5r3

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.30.5r3
Netapp » E-Series Santricity Os Controller » Version: 11.40

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.40
Netapp » E-Series Santricity Os Controller » Version: 11.40.3r2

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.40.3r2
Netapp » E-Series Santricity Os Controller » Version: 11.40.5

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.40.5
Netapp » E-Series Santricity Os Controller » Version: 11.50.1

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.50.1
Netapp » E-Series Santricity Os Controller » Version: 11.50.2

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.50.2
Netapp » E-Series Santricity Os Controller » Version: 11.60

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60
Netapp » E-Series Santricity Os Controller » Version: 11.60.0

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60.0
Netapp » E-Series Santricity Os Controller » Version: 11.60.1

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60.1
Netapp » E-Series Santricity Os Controller » Version: 11.60.3

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.60.3
Netapp » E-Series Santricity Os Controller » Version: 11.70.1

cpe:2.3:a:netapp:e-series_santricity_os_controller:11.70.1
Netapp » E-Series Santricity Web Services » Version: N/A

cpe:2.3:a:netapp:e-series_santricity_web_services:-
Netapp » Element Plug-In For Vcenter Server » Version: N/A

cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-
Netapp » Santricity Cloud Connector » Version: N/A

cpe:2.3:a:netapp:santricity_cloud_connector:-
Netapp » Snapcenter » Version: N/A

cpe:2.3:a:netapp:snapcenter:-
Netapp » Snapcenter Plug-In » Version: N/A

cpe:2.3:a:netapp:snapcenter_plug-in:-
Netapp » Storage Replication Adapter For Clustered Data Ontap » Version: 9.6

cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6
Netapp » Storage Replication Adapter For Clustered Data Ontap » Version: 9.7

cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.7
Netapp » Vasa Provider For Clustered Data Ontap » Version: 9.6

cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:9.6
Netapp » Vasa Provider For Clustered Data Ontap » Version: 9.7

cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:9.7
Netapp » Virtual Storage Console » Version: 9.6

cpe:2.3:a:netapp:virtual_storage_console:9.6
Netapp » Virtual Storage Console » Version: 9.7

cpe:2.3:a:netapp:virtual_storage_console:9.7
Oracle » Autovue For Agile Product Lifecycle Management » Version: 21.0.2

cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2
Oracle » Banking Apis » Version: 20.1

cpe:2.3:a:oracle:banking_apis:20.1
Oracle » Banking Apis » Version: 21.1

cpe:2.3:a:oracle:banking_apis:21.1
Oracle » Banking Digital Experience » Version: 20.1

cpe:2.3:a:oracle:banking_digital_experience:20.1
Oracle » Banking Digital Experience » Version: 21.1

cpe:2.3:a:oracle:banking_digital_experience:21.1
Oracle » Communications Session Route Manager » Version: 8.0.0

cpe:2.3:a:oracle:communications_session_route_manager:8.0.0
Oracle » Communications Session Route Manager » Version: 8.1.0

cpe:2.3:a:oracle:communications_session_route_manager:8.1.0
Oracle » Communications Session Route Manager » Version: 8.1.1

cpe:2.3:a:oracle:communications_session_route_manager:8.1.1
Oracle » Communications Session Route Manager » Version: 8.2.0

cpe:2.3:a:oracle:communications_session_route_manager:8.2.0
Oracle » Communications Session Route Manager » Version: 8.2.0.0

cpe:2.3:a:oracle:communications_session_route_manager:8.2.0.0
Oracle » Communications Session Route Manager » Version: 8.2.1

cpe:2.3:a:oracle:communications_session_route_manager:8.2.1
Oracle » Communications Session Route Manager » Version: 8.2.2

cpe:2.3:a:oracle:communications_session_route_manager:8.2.2
Oracle » Communications Session Route Manager » Version: 8.2.2.1

cpe:2.3:a:oracle:communications_session_route_manager:8.2.2.1
Oracle » Communications Session Route Manager » Version: 8.2.4

cpe:2.3:a:oracle:communications_session_route_manager:8.2.4
Oracle » Siebel Core - Automation » Version: N/A

cpe:2.3:a:oracle:siebel_core_-_automation:-
Oracle » Siebel Core - Automation » Version: 21.5

cpe:2.3:a:oracle:siebel_core_-_automation:21.5
Oracle » Siebel Core - Automation » Version: 21.9

cpe:2.3:a:oracle:siebel_core_-_automation:21.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-28164

Products

Pricing

Contact Us