WaratekVRT Sign in

CVE-2021-34429 Eclipse Jetty

Affected softwareEclipse Jetty
Severity5.3 Medium CVSS 3.1 3 scores
Fixed in9.4.43, 10.0.6, 11.0.6
WeaknessIncorrect authorization (CWE-863)
Published15 Jul 2021
Updated13 Nov 2026

Description

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

CWE-200 · Information exposureCWE-551

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2023-01-12.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2021-11-03.
  • EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-34429 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation web.archive.org /web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022 2023-01-12
IndexArtifactStarsFirst seen
GitHub PoC POC for CVE-2021-34429 - Eclipse Jetty 11.0.5 Sensitive File Disclosure 6 2021-11-03
Exploit-DB Eclipse Jetty 11.0.5 - Sensitive File Disclosure 2021-11-03
Nuclei Eclipse Jetty - Information Disclosure

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Filesytem read for WEB-INF folder.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Filesytem read for WEB-INF folder

How to mitigate CVE-2021-34429

Upgrade Eclipse Jetty to a release that fixes it: 9.4.43, 10.0.6 or 11.0.6. Until you can, Waratek RASP blocks exploitation with its filesystem rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

5.3 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N emo@eclipse.org Secondary published
CVSS 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N NVD Primary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Fusion Middleware / Runtime Engine (Apache ZooKeeper) (12.2.1.4.0)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Fusion Middleware / Runtime Java agent for ODI (Eclipse Jetty) (12.2.1.3.0, 12.2.1.4.0)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Financial Services Applications / Studio (Eclipse Jetty) (8.0.8.2.0, 8.0.8.3.0)
Oracle GoldenGate / Oracle Stream Analytics (Eclipse Jetty) (19c: prior to 19.1.0.0.6.4)
Oracle REST Data Services / Oracle REST Data Services (Eclipse Jetty) (Prior to 22.1.1)
Oracle Supply Chain / Internal Operations (Eclipse Jetty) (21.0.2)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Retail Applications / Framework (Eclipse Jetty) (20.0.1)
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Communications / API Gateway (Eclipse Jetty) (8.0.0.0-8.5.0.2)
Oracle Communications / Binding Support Function (Eclipse Jetty) (1.10.0)
Oracle Communications / SCP (Eclipse Jetty) (1.14.0)
Oracle Communications / SEPP (Eclipse Jetty) (1.5.0)
Oracle Communications / UDR (Eclipse Jetty) (1.14.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications API Gateway (Eclipse Jetty) 8.0.0.0-8.5.0.2
Oracle Communications Binding Support Function (Eclipse Jetty) 1.10.0 1.10.0
Oracle Communications SCP (Eclipse Jetty) 1.14.0 1.14.0
Oracle Communications SEPP (Eclipse Jetty) 1.5.0 1.5.0
Oracle Communications UDR (Eclipse Jetty) 1.14.0 1.14.0
Oracle Financial Services Applications Studio (Eclipse Jetty) 8.0.8.2.0, 8.0.8.3.0 8.0.8.2.0 · 8.0.8.3.0
Oracle Fusion Middleware Runtime Engine (Apache ZooKeeper) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Runtime Java agent for ODI (Eclipse Jetty) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle GoldenGate Oracle Stream Analytics (Eclipse Jetty) 19c: prior to 19.1.0.0.6.4 19.19.1.0.0.6
Oracle REST Data Services Oracle REST Data Services (Eclipse Jetty) Prior to 22.1.1
Oracle Retail Applications Framework (Eclipse Jetty) 20.0.1 20.0.1
Oracle Supply Chain Internal Operations (Eclipse Jetty) 21.0.2 21.0.2

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.eclipse.jetty:jetty-webapp 9.4.37 9.4.43 unbounded
org.eclipse.jetty:jetty-webapp 10.0.1 10.0.6 unbounded
org.eclipse.jetty:jetty-webapp 11.0.1 11.0.6 unbounded

Products and versions

19 products, 25 version entries
SourceVendorProductSchemeAffected versions
nvd eclipse jetty generic ≥ 9.4.37 and ＜ 9.4.43 · ≥ 10.0.1 and ＜ 10.0.6 · ≥ 11.0.1 and ＜ 11.0.6
nvd netapp e-series santricity os controller generic ≥ 11.0 and ≤ 11.70.1
nvd netapp e-series santricity web services generic any version
nvd netapp element plug-in for vcenter server generic any version
nvd netapp hci management node generic any version
nvd netapp snap creator framework generic any version
nvd netapp snapcenter plug-in generic any version
nvd netapp solidfire generic any version
nvd oracle autovue for agile product lifecycle management generic 21.0.2
nvd oracle communications cloud native core binding support function generic 1.10.0
nvd oracle communications cloud native core security edge protection proxy generic 1.5.0
nvd oracle communications cloud native core service communication proxy generic 1.14.0
nvd oracle communications cloud native core unified data repository generic 1.14.0
nvd oracle communications diameter signaling router generic ≥ 8.0.0.0 and ≤ 8.5.0.2
nvd oracle financial services crime and compliance management studio generic 8.0.8.2.0 · 8.0.8.3.0
nvd oracle rest data services generic ＜ 22.1.1
nvd oracle retail eftlink generic 20.0.1
nvd oracle stream analytics generic 19c · ＜ 19.1.0.0.6.4
osv org.eclipse.jetty jetty-webapp generic ≥ 9.4.37 and ＜ 9.4.43 · ≥ 10.0.1 and ＜ 10.0.6 · ≥ 11.0.1 and ＜ 11.0.6

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, TCP, UDR (ECLIPSE JETTY), BINDING SUPPORT FUNCTION (ECLIPSE JETTY), API GATEWAY (ECLIPSE JETTY), NO AUTH REMOTE EXPLOIT, SCP (ECLIPSE JETTY), SEPP (ECLIPSE JETTY) **Products:** ORACLE COMMUNICATIONS CLOUD NATIVE CORE SECURITY EDGE PROTECTION PROXY, ORACLE COMMUNICATIONS CLOUD NATIVE CORE UNIFIED DATA REPOSITORY, ORACLE COMMUNICATIONS CLOUD NATIVE CORE BINDING SUPPORT FUNCTION, ORACLE COMMUNICATIONS CLOUD NATIVE CORE SERVICE COMMUNICATION PROXY, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER, ORACLE COMMUNICATIONS

References

URLTags
https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm WEB
https://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82@%3Cdev.zookeeper.apache.org%3E WEB
https://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951@%3Cissues.zookeeper.apache.org%3E WEB
https://lists.apache.org/thread.html/r833a4c8bdbbfeb8a2cd38238e7b59f83edd5c1a0e508b587fc551a46@%3Cissues.hbase.apache.org%3E WEB
https://lists.apache.org/thread.html/r8e6c116628c1277c3cf132012a66c46a0863fa2a3037c0707d4640d4@%3Cissues.zookeeper.apache.org%3E WEB
https://lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab@%3Cissues.zookeeper.apache.org%3E WEB
https://lists.apache.org/thread.html/r9d245c6c884bbc804a472116d730c1a01676bf24f93206a34923fc64@%3Ccommits.kafka.apache.org%3E WEB
https://lists.apache.org/thread.html/r9e6158d72ef25077c2dc59fbddade2eacf7d259a2556c97a989f2fe8@%3Ccommits.pulsar.apache.org%3E WEB
https://lists.apache.org/thread.html/rb33d65c3e5686f2e3b9bb8a032a44163b2f2ad9d31a8727338f213c1@%3Ccommits.pulsar.apache.org%3E WEB
https://lists.apache.org/thread.html/rc26807be68748b3347decdcd03ae183622244b0b4cb09223d4b7e500@%3Ccommits.pulsar.apache.org%3E WEB

Timeline
Published2021-07-15By the CVE Program.
VulnCheck KEV: earliest evidence2023-01-12Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.