CVE-2021-34429

eclipse jetty, netapp e-series santricity os controller, netapp e-series santricity web services +15 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-34429

Katalog CVE

CVSS 5.3 · Medium EPSS 99,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada eclipse jetty, netapp e-series santricity os controller +16 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Rincian

Terbit di NVD
15 Juli 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
EPSS (30 hari)
99,3% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
eclipse jetty Versi 9.4.37 hingga sebelum 9.4.43
eclipse jetty Versi 10.0.1 hingga sebelum 10.0.6
eclipse jetty Versi 11.0.1 hingga sebelum 11.0.6
netapp e-series santricity os controller Versi 11.0 hingga 11.70.1
netapp e-series santricity web services Semua versi
netapp element plug-in for vcenter server Semua versi
netapp hci management node Semua versi
netapp snap creator framework Semua versi
netapp snapcenter plug-in Semua versi
netapp solidfire Semua versi
oracle autovue for agile product lifecycle management Versi 21.0.2
oracle communications cloud native core binding support function Versi 1.10.0
oracle communications cloud native core security edge protection proxy Versi 1.5.0
oracle communications cloud native core service communication proxy Versi 1.14.0
oracle communications cloud native core unified data repository Versi 1.14.0
oracle communications diameter signaling router Versi 8.0.0.0 hingga 8.5.0.2
oracle financial services crime and compliance management studio Versi 8.0.8.2.0
oracle financial services crime and compliance management studio Versi 8.0.8.3.0
oracle rest data services Semua versi sebelum 22.1.1
oracle retail eftlink Versi 20.0.1
oracle stream analytics Semua versi sebelum 19.1.0.0.6.4
oracle stream analytics Versi 19c

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.