CVE-2021-28164: Input Validation
Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by improper input validation by the default compliance mode. By sending specially-crafted requests with URIs that contain %2e or %2e%2e segments, an attacker could exploit this vulnerability to access protected resources within the WEB-INF directory, and use this information to launch further attacks against the affected system.
Other sources
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-28164?
The severity of CVE-2021-28164 is medium with a CVSS score of 5.3.
How does CVE-2021-28164 work?
CVE-2021-28164 allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory.
Which versions of Jetty are affected by CVE-2021-28164?
Eclipse Jetty versions 9.4.37.v20210219 to 9.4.38.v20210224 are affected by CVE-2021-28164.
How can I fix CVE-2021-28164?
Update your Eclipse Jetty installation to version 9.4.40-1.1.el7_9 or higher, or update your Jetty installation to version 9.4.39 or higher.
Where can I find more information about CVE-2021-28164?
You can find more information about CVE-2021-28164 on the CVE website, NVD website, GitHub security advisories, Red Hat Bugzilla, and Red Hat Errata.