In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00154.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
The Eclipse Foundation Eclipse Jetty affected
Version Status Constraints
9.4.32 affected < unspecified
unspecified affected ≤ 9.4.38
10.0.0.beta2 affected < unspecified
unspecified affected ≤ 10.0.1
11.0.0.beta2 affected < unspecified
unspecified affected ≤ 11.0.1

Configuration 1 [-]

OR cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:-:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.1:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*

Configuration 5 [-]

OR cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat AMQ 7.8.2
jetty-server cpe:/a:redhat:amq_broker:7 RHSA-2021:2689 2021-07-12T00:00:00Z
Red Hat AMQ 7.9.0
jetty-server cpe:/a:redhat:amq_broker:7 RHSA-2021:3700 2021-09-30T00:00:00Z
Red Hat AMQ Streams 1.6.4
jetty-server cpe:/a:redhat:amq_streams:1 RHSA-2021:1560 2021-05-13T00:00:00Z
Red Hat AMQ Streams 1.8.0
jetty-server cpe:/a:redhat:amq_streams:1 RHSA-2021:3225 2021-08-19T00:00:00Z
Red Hat Developer Tools
rh-eclipse-jetty-0:9.4.40-1.1.el7_9 cpe:/a:redhat:devtools:2021 RHSA-2021:1509 2021-05-06T00:00:00Z
Red Hat Fuse 7.10
jetty cpe:/a:redhat:jboss_fuse:7 RHSA-2021:5134 2021-12-14T00:00:00Z
Red Hat Integration Camel Quarkus 1
jetty cpe:/a:redhat:camel_quarkus:2.2 RHSA-2021:4767 2021-11-23T00:00:00Z
Red Hat OpenShift Container Platform 4.7
jenkins-0:2.277.3.1620393611-1.el8 cpe:/a:redhat:openshift:4.7::el7 RHSA-2021:1551 2021-05-19T00:00:00Z
runc-0:1.0.0-95.rhaos4.8.gitcd80260.el7 cpe:/a:redhat:openshift:4.7::el7 RHSA-2021:1551 2021-05-19T00:00:00Z
RHAF Camel-K 1.8
jetty cpe:/a:redhat:integration:1 RHSA-2022:6407 2022-09-09T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Apache Subscribe
Ignite Subscribe
Solr Subscribe
Eclipse Subscribe
Jetty Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Netapp Subscribe
Cloud Manager Subscribe
E-series Performance Analyzer Subscribe
E-series Santricity Os Controller Subscribe
E-series Santricity Web Services Subscribe
Element Plug-in For Vcenter Server Subscribe
Santricity Cloud Connector Subscribe
Snapcenter Subscribe
Snapcenter Plug-in Subscribe
Storage Replication Adapter For Clustered Data Ontap Subscribe
Vasa Provider For Clustered Data Ontap Subscribe
Virtual Storage Console Subscribe
Oracle Subscribe
Autovue For Agile Product Lifecycle Management Subscribe
Banking Apis Subscribe
Banking Digital Experience Subscribe
Communications Element Manager Subscribe
Communications Services Gatekeeper Subscribe
Communications Session Report Manager Subscribe
Communications Session Route Manager Subscribe
Siebel Core - Automation Subscribe
Redhat Subscribe
Amq Broker Subscribe
Amq Streams Subscribe
Camel Quarkus Subscribe
Devtools Subscribe
Integration Subscribe
Jboss Fuse Subscribe
Openshift Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-0837 In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
Github GHSA Github GHSA GHSA-j6qj-j888-vvgq Directory exposure in jetty
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq cve-icon cve-icon cve-icon
https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r787e47297a614b05b99d01b04c8a1d6c0cafb480c9cb7c624a6b8fc3%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-28163 cve-icon
https://security.netapp.com/advisory/ntap-20210611-0006/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-28163 cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2024-08-03T21:40:12.280Z

Reserved: 2021-03-12T00:00:00

Link: CVE-2021-28163

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-04-01T15:15:14.080

Modified: 2024-11-21T05:59:12.987

Link: CVE-2021-28163

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-04-01T00:00:00Z

Links: CVE-2021-28163 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses