p PatchFirst

CVE-2021-28163

CVE-2021-28163

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

CVSS 2.7 · Low · EPSS 4.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ 9.4.32, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 9.4.38: Affected (custom)
    • ≥ 10.0.0.beta2, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 10.0.1: Affected (custom)
    • ≥ 11.0.0.beta2, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 11.0.1: Affected (custom)

    No fix published

  • jetty9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.4.39-1

    Update to 9.4.39-1

  • jetty9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.4.39-1

    Update to 9.4.39-1

  • jetty9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.4.39-1

    Update to 9.4.39-1

  • equinox-bundles Ubuntu:18.04:LTS

    Versions
    • 4.9-2~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • equinox-bundles Ubuntu:20.04:LTS

    Versions
    • 4.12-1
    • 4.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • equinox-bundles Ubuntu:22.04:LTS

    Versions
    • 4.18-1
    • 4.19-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →