Login Request a demo
Low severity · published Apr 1, 2021
CVE-2021-28163
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory…
2.7
CVSS
4.2%
EPSS
No
On KEV
Description
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Autovue For Agile Product Lifecycle Management · Oracle
21.0.2 · source: NVD
BA
Banking Apis · Oracle
20.1; 21.1 · source: NVD
BD
Banking Digital Experience · Oracle
20.1; 21.1 · source: NVD
CM
Cloud Manager · Netapp
All versions, or not specified · source: NVD
CE
Communications Element Manager · Oracle
8.2.2 · source: NVD
CS
Communications Services Gatekeeper · Oracle
7.0 · source: NVD
CS
Communications Session Report Manager · Oracle
8.0.0 through 8.2.4.0 · source: NVD
CS
Communications Session Route Manager · Oracle
8.0.0 through 8.2.4.0 · source: NVD
EP
E-series Performance Analyzer · Netapp
All versions, or not specified · source: NVD
ES
E-series Santricity OS Controller · Netapp
11.0.0 through 11.70.1 · source: NVD
ES
E-series Santricity Web Services · Netapp
All versions, or not specified · source: NVD
EP
Element Plug-in For Vcenter Server · Netapp
All versions, or not specified · source: NVD
Affected product
IG
Ignite
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28163
Exploit
https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq
lists.apache.org
https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3E
More from Ignite
9.8
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of…
9.8
CVE-2018-8018
In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it…
9.8
CVE-2018-1295
In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary…
9.1
CVE-2020-1963
Apache Ignite uses H2 database to build SQL distributed execution engine
9.0
CVE-2024-52577
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints