CVE-2021-28164 Authorization Before Parsing and Canonicalization in jetty
Attackers can access protected WEB-INF files via encoded path traversal, exposing sensitive application configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28164?
CVE-2021-28164 is a medium-severity path traversal vulnerability in Eclipse Jetty, published on 1 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Which versions are affected by CVE-2021-28164?
2 open source packages ship an affected version, including org.eclipse.jetty:jetty-webapp. It affects 17 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-webapp Maven | From 9.4.37 | 9.4.39 |
org.eclipse.jetty:jetty-webapp Maven | From 9.4.37 | 9.4.39 |
Products include Eclipse Jetty, Netapp Cloud Manager, Netapp E-Series Performance Analyzer, Netapp E-Series Santricity Os Controller, Netapp E-Series Santricity Web Services, Netapp Element Plug-in for Vcenter Server and 11 more.
How do I fix CVE-2021-28164?
Upgrade org.eclipse.jetty:jetty-webapp to 9.4.39 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-28164 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-28164 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as DEBIAN-CVE-2021-28164, GHSA-v7ff-8wcx-gmc5, UBUNTU-CVE-2021-28164.