CVE-2021-28163

Published: Apr 1, 2021Modified: Jun 17, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.2 / Impact: 1.4

Source: NVD

Description

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Affected (33)

Products: Eclipse: Jetty · Fedoraproject: Fedora · Apache: Ignite, Solr · +2 more

Show all products

1 product

1 product

2 products

11 products

E Series Performance Analyzer

E Series Santricity Os Controller

E Series Santricity Web Services

Element Plug In For Vcenter Server

Santricity Cloud Connector

Snapcenter

Snapcenter Plug In

Storage Replication Adapter For Clustered Data Ontap

Vasa Provider For Clustered Data Ontap

Virtual Storage Console

Oracle

8 products

Autovue For Agile Product Lifecycle Management

Banking Apis

Banking Digital Experience

Communications Element Manager

Communications Services Gatekeeper

Communications Session Report Manager

Communications Session Route Manager

Siebel Core Automation

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Eclipse Jetty	From 9.4.32 to 9.4.39
Eclipse Jetty	Version 10.0.0 beta2
Eclipse Jetty	Version 10.0.1
Eclipse Jetty	Version 11.0.0
Eclipse Jetty	Version 11.0.0 beta2
Eclipse Jetty	Version 11.0.0 beta3
Eclipse Jetty	Version 11.0.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Apache Ignite	Before 2.1.1
Apache Solr	Version 8.8.1

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Manager	All versions
Netapp E Series Performance Analyzer	All versions
Netapp E Series Santricity Os Controller	From 11.0.0 to 11.70.1
Netapp E Series Santricity Web Services	All versions
Netapp Element Plug In For Vcenter Server	All versions
Netapp Santricity Cloud Connector	All versions
Netapp Snapcenter	All versions
Netapp Snapcenter Plug In	All versions
Netapp Storage Replication Adapter For Clustered Data Ontap	From 9.6
Netapp Vasa Provider For Clustered Data Ontap	From 9.6
Netapp Virtual Storage Console	From 9.6

Configuration E

10 vulnerable

Vulnerable Software	Affected Versions
Oracle Autovue For Agile Product Lifecycle Management	Version 21.0.2
Oracle Banking Apis	Version 20.1
Oracle Banking Apis	Version 21.1
Oracle Banking Digital Experience	Version 20.1
Oracle Banking Digital Experience	Version 21.1
Oracle Communications Element Manager	Version 8.2.2
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Session Report Manager	From 8.0.0 to 8.2.4.0
Oracle Communications Session Route Manager	From 8.0.0 to 8.2.4.0
Oracle Siebel Core Automation	Up to 21.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (52)

https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq

Source: emo@eclipse.org

ExploitThird Party Advisory

https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r787e47297a614b05b99d01b04c8a1d6c0cafb480c9cb7c624a6b8fc3%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E

Source: emo@eclipse.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI/

Source: emo@eclipse.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS/

Source: emo@eclipse.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF/

Source: emo@eclipse.org

https://security.netapp.com/advisory/ntap-20210611-0006/

Source: emo@eclipse.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: emo@eclipse.org

Not ApplicableThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: emo@eclipse.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: emo@eclipse.org

PatchThird Party Advisory

https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq