CVEvulnerability

CVE-2021-28163

2.7 LOW Published 2021-04-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-04-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-59

Description

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Affected configurations

• eclipse jetty (>= 9.4.32 < 9.4.39) • eclipse jetty 10.0.0 • eclipse jetty 10.0.1 • eclipse jetty 11.0.0 • eclipse jetty 11.0.1 • fedoraproject fedora 32 • fedoraproject fedora 33 • fedoraproject fedora 34 • apache ignite (< 2.1.1) • apache solr 8.8.1 • netapp cloud manager • netapp e-series performance analyzer • netapp e-series santricity os controller (>= 11.0.0 <= 11.70.1) • netapp e-series santricity web services • netapp element plug-in for vcenter server • netapp santricity cloud connector • netapp snapcenter • netapp snapcenter plug-in • netapp storage replication adapter for clustered data ontap (>= 9.6) • netapp vasa provider for clustered data ontap (>= 9.6) • netapp virtual storage console (>= 9.6) • oracle autovue for agile product lifecycle management 21.0.2 • oracle banking apis 20.1 • oracle banking apis 21.1 • oracle banking digital experience 20.1 • oracle banking digital experience 21.1 • oracle communications element manager 8.2.2 • oracle communications services gatekeeper 7.0 • oracle communications session report manager (>= 8.0.0 <= 8.2.4.0) • oracle communications session route manager (>= 8.0.0 <= 8.2.4.0) • oracle siebel core - automation (<= 21.9)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References