Vulnerabilities > CVE-2021-28164

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

eclipse

netapp

oracle

NVD

Published: 2021-04-01

Updated: 2024-11-21

Summary

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Vulnerable Configurations

Part	Description	Count
Application	Eclipse Eclipse Jetty 9.4.37 Eclipse Jetty 9.4.38	2
Application	Netapp Netapp Santricity Cloud Connector - Netapp Snapcenter - Netapp E Series Performance Analyzer - Netapp E Series Santricity WEB Services - Netapp Virtual Storage Console 9.6 Netapp Virtual Storage Console 9.7 Netapp Storage Replication Adapter FOR Clustered Data Ontap 9.6 Netapp Storage Replication Adapter FOR Clustered Data Ontap 9.7 Netapp Vasa Provider FOR Clustered Data Ontap 9.6 Netapp Vasa Provider FOR Clustered Data Ontap 9.7 Netapp Cloud Manager - Netapp Snapcenter Plug IN - Netapp E Series Santricity OS Controller 11.0 Netapp E Series Santricity OS Controller 11.0.0 Netapp E Series Santricity OS Controller 11.20 Netapp E Series Santricity OS Controller 11.25 Netapp E Series Santricity OS Controller 11.30 Netapp E Series Santricity OS Controller 11.30.5R3 Netapp E Series Santricity OS Controller 11.40 Netapp E Series Santricity OS Controller 11.40.3R2 Netapp E Series Santricity OS Controller 11.40.5 Netapp E Series Santricity OS Controller 11.50.1 Netapp E Series Santricity OS Controller 11.50.2 Netapp E Series Santricity OS Controller 11.60 Netapp E Series Santricity OS Controller 11.60.0 Netapp E Series Santricity OS Controller 11.60.1 Netapp E Series Santricity OS Controller 11.60.3 Netapp E Series Santricity OS Controller 11.70.1 Netapp Element Plug IN FOR Vcenter Server -	30
Application	Oracle Oracle Banking Digital Experience 20.1 Oracle Banking Digital Experience 21.1 Oracle Autovue FOR Agile Product Lifecycle Management 21.0.2 Oracle Siebel Core Automation - Oracle Siebel Core Automation 21.5 Oracle Siebel Core Automation 21.9 Oracle Communications Session Route Manager 8.0.0 Oracle Communications Session Route Manager 8.1.0 Oracle Communications Session Route Manager 8.1.1 Oracle Communications Session Route Manager 8.2.0 Oracle Communications Session Route Manager 8.2.0.0 Oracle Communications Session Route Manager 8.2.1 Oracle Communications Session Route Manager 8.2.2 Oracle Communications Session Route Manager 8.2.2.1 Oracle Communications Session Route Manager 8.2.4 Oracle Banking Apis 20.1 Oracle Banking Apis 21.1	17

Vulnerabilities > CVE-2021-28164 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2021-28164"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2021-28164