CVE-2021-28163
Low
Description
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
SeverityLow
CVSS2.7
Exploit probability—
Product
Eclipse Jetty
PublishedApr 1, 2021
First seenApr 1, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- eclipse jetty9.4.39 or later
- apache ignite2.1.1 or later
- org.eclipse.jetty:jetty-deploy9.4.39, 10.0.2, 11.0.2 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.4.32 ≤ v < 9.4.39, 10.0.0, 10.0.1, 11.0.0, 11.0.1 | 9.4.39 |
| fedoraproject fedora | 32, 33, 34 | — |
| apache ignite | v < 2.1.1 | 2.1.1 |
| apache solr | 8.8.1 | — |
| netapp cloud_manager | No range specified | — |
| netapp e-series_performance_analyzer | No range specified | — |
| netapp e-series_santricity_os_controller | 11.0.0 ≤ v ≤ 11.70.1 | — |
| netapp e-series_santricity_web_services | No range specified | — |
| netapp element_plug-in_for_vcenter_server | No range specified | — |
| netapp santricity_cloud_connector | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp snapcenter_plug-in | No range specified | — |
| netapp storage_replication_adapter_for_clustered_data_ontap | 9.6 ≤ v | — |
| netapp vasa_provider_for_clustered_data_ontap | 9.6 ≤ v | — |
| netapp virtual_storage_console | 9.6 ≤ v | — |
| oracle autovue_for_agile_product_lifecycle_management | 21.0.2 | — |
| oracle banking_apis | 20.1, 21.1 | — |
| oracle banking_digital_experience | 20.1, 21.1 | — |
| oracle communications_element_manager | 8.2.2 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_session_report_manager | 8.0.0 ≤ v ≤ 8.2.4.0 | — |
| oracle communications_session_route_manager | 8.0.0 ≤ v ≤ 8.2.4.0 | — |
| oracle siebel_core_-_automation | v ≤ 21.9 | — |
| org.eclipse.jetty:jetty-deployMaven | 9.4.32 ≤ v < 9.4.39, 10.0.0 ≤ v < 10.0.2, 11.0.0 ≤ v < 11.0.2 | 9.4.39, 10.0.2, 11.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.