{"cve_id":"CVE-2021-34429","published":"2021-07-15T17:15:08.637000+00:00","last_modified":"2026-06-17T03:55:50.803000+00:00","vuln_status":"Modified","description":"For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","base_score":5.3,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"LOW","impact_i":"NONE","impact_a":"NONE","cwe_ids":["CWE-200","CWE-551"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.9933,"epss_percentile":0.99939,"cap_rule_version":"0.1.1","stage":"RECON","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"NONE","caps":["INFO_DISCLOSURE"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:46:15.678744+00:00","first_seen":"2021-07-15T17:15:08.637000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["eclipse","netapp","oracle"],"products":["autovue_for_agile_product_lifecycle_management","communications_cloud_native_core_binding_support_function","communications_cloud_native_core_security_edge_protection_proxy","communications_cloud_native_core_service_communication_proxy","communications_cloud_native_core_unified_data_repository","communications_diameter_signaling_router","e-series_santricity_os_controller","e-series_santricity_web_services","element_plug-in_for_vcenter_server","financial_services_crime_and_compliance_management_studio","hci_management_node","jetty","rest_data_services","retail_eftlink","snap_creator_framework","snapcenter_plug-in","solidfire","stream_analytics"],"affected":[{"vendor":"eclipse","product":"jetty","ranges":["≥ 9.4.37 and < 9.4.43","≥ 10.0.1 and < 10.0.6","≥ 11.0.1 and < 11.0.6"]},{"vendor":"netapp","product":"e-series_santricity_os_controller","ranges":["≥ 11.0 and ≤ 11.70.1"]},{"vendor":"netapp","product":"e-series_santricity_web_services","ranges":["all versions"]},{"vendor":"netapp","product":"element_plug-in_for_vcenter_server","ranges":["all versions"]},{"vendor":"netapp","product":"hci_management_node","ranges":["all versions"]},{"vendor":"netapp","product":"snap_creator_framework","ranges":["all versions"]},{"vendor":"netapp","product":"snapcenter_plug-in","ranges":["all versions"]},{"vendor":"netapp","product":"solidfire","ranges":["all versions"]},{"vendor":"oracle","product":"autovue_for_agile_product_lifecycle_management","ranges":["21.0.2"]},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function","ranges":["1.10.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy","ranges":["1.5.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy","ranges":["1.14.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_unified_data_repository","ranges":["1.14.0"]},{"vendor":"oracle","product":"communications_diameter_signaling_router","ranges":["≥ 8.0.0.0 and ≤ 8.5.0.2"]},{"vendor":"oracle","product":"financial_services_crime_and_compliance_management_studio","ranges":["8.0.8.2.0","8.0.8.3.0"]},{"vendor":"oracle","product":"rest_data_services","ranges":["< 22.1.1"]},{"vendor":"oracle","product":"retail_eftlink","ranges":["20.0.1"]},{"vendor":"oracle","product":"stream_analytics","ranges":["< 19.1.0.0.6.4","19c"]}]}