CVE:CVE-2021-28164
CNNVD:CNNVD-202104-036
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。
Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 存在安全漏洞，该漏洞允许请求的uri包含%2e or %2e%2e访问WEB-INF目录中受保护资源。
solution:Upgrade eclipse jetty to a higher version than 9.4.37:20210219,9.4.38:20210224,and avoid the version 9.4.37:20210219,9.4.38:20210224; Upgrade netapp cloud_manager to a higher version than -; Upgrade netapp e-series_performance_analyzer to a higher version than -; Upgrade netapp e-series_santricity_os_controller to a higher version than 11.70.1,and avoid the version [11.0,11.70.1]; Upgrade netapp e-series_santricity_web_services to a higher version than -; Upgrade netapp element_plug-in_for_vcenter_server to a higher version than -; Upgrade netapp santricity_cloud_connector to a higher version than -; Upgrade netapp snapcenter to a higher version than -; Upgrade netapp snapcenter_plug-in to a higher version than -; netapp storage_replication_adapter_for_clustered_data_ontap avoid the version [9.6,); netapp vasa_provider_for_clustered_data_ontap avoid the version [9.6,); netapp virtual_storage_console avoid the version [9.6,); Upgrade oracle autovue_for_agile_product_lifecycle_management to a higher version than 21.0.2,and avoid the version 21.0.2; Upgrade oracle banking_apis to a higher version than 20.1,21.1,and avoid the version 20.1,21.1; Upgrade oracle banking_digital_experience to a higher version than 20.1,21.1,and avoid the version 20.1,21.1; Upgrade oracle communications_session_route_manager to a higher version than 8.2.4,and avoid the version [8.0.0,8.2.4]; Upgrade oracle siebel_core_-_automation to a higher version than 21.9,and avoid the version (,21.9]