Homepage

Information Exposure The advisory has been revoked - it doesn't affect any version of package rh-eclipse-jetty-xml  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
78.48% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-RHECLIPSEJETTYXML-11350944
  • published1 Aug 2025
  • disclosed8 Jun 2021
Report a new vulnerability Found a mistake?

Introduced: 8 Jun 2021

CVE-2021-28169  (opens in a new tab)
CWE-200  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rh-eclipse-jetty-xml package and not the rh-eclipse-jetty-xml package as distributed by RHEL.

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

References