Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2021-28163

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory i

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Eclipse Foundation Eclipse Jetty

  • 9.4.32 to < unspecifiedaffected
  • unspecified to ≤ 9.4.38affected
  • 10.0.0.beta2 to < unspecifiedaffected
  • unspecified to ≤ 10.0.1affected
  • 11.0.0.beta2 to < unspecifiedaffected
  • unspecified to ≤ 11.0.1affected

References