What’s Vulnerable › Vulnerabilities
CVE-2021-34429
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 99.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-07-15 · updated 2026-06-17
- Weakness: CWE-200
Description
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Affected products
- The Eclipse Foundation Eclipse Jetty: from 9.4.37 before 9.4.43; from 10.0.1 before 10.0.6; from 11.0.1 before 11.0.6 — fixed in 10.0.6, 11.0.6, 9.4.43
- E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.70.1
- NetApp E-Series Santricity Web Services: all versions
- NetApp, Inc. Element Plug-in for vCenter Server: all versions
- NetApp Hci Management Node: all versions
- NetApp Snap Creator Framework: all versions
- NetApp SnapCenter Plugin for VMware vSphere: all versions
- NetApp Solidfire: all versions
- Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
- Oracle Communications Cloud Native Core Binding Support Function: 1.10.0
- Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.5.0
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.14.0
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.5.0.2
- Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
- Oracle Corporation Oracle REST Data Services: before 22.1.1 — fixed in 22.1.1
- Oracle Corporation Oracle Retail EFTLink: 20.0.1
- Oracle Stream Analytics: before 19.1.0.0.6.4; 19c — fixed in 19.1.0.0.6.4
How to fix
Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 10.0.6, 11.0.6, 9.4.43; Oracle Corporation Oracle REST Data Services 22.1.1; Oracle Stream Analytics 19.1.0.0.6.4. Check the vendor advisory for mitigations.
References
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
- https://lists.apache.org/thread.html/r029c0c6833c8bb6acb094733fd7b75029d633f47a92f1c9d14391fc0%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r02f940c27e997a277ff14e79e84551382e1081e8978b417e0c2b0857%40%3Ccommits.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r0626f279ebf65506110a897e3a57ccd4072803ee5434b2503e070398%40%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2e32390cb7aedb39069e5b18aa130ca53e766258518faee63c31d3ea%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r3aefe613abce594c71ace50088d2529bbde65d08b8e7ff2c2723aaa1%40%3Cdev.santuario.apache.org%3E
- https://lists.apache.org/thread.html/r3c55b0baa4dc38958ae147b2f216e212605f1071297f845e14477d36%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r44ea39ca8110de7353bfec88f58aa3aa58a42bb324b8772512ee190c%40%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r46900f74dbb7d168aeac43bf0e7f64825376bb7eb74d31a5b33344ce%40%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r46f748c1dc9cf9b6c1c18f6b5bfc3a869907f68f72e17666f2f30f24%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r4727d282b5c2d951057845a46065d59f6e33132edc0a14f41c26b01e%40%3Cdev.kafka.apache.org%3E
Get alerted when CVE-2021-34429 or the next vulnerability affects your stack