PT-2021-7304 · Eclipse+2 · Eclipse Jetty+2

Published 2021-04-01 · Updated 2024-03-06 · CVE-2021-28163

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.32 through 9.4.38 Eclipse Jetty versions 10.0.0.beta2 through 10.0.1 Eclipse Jetty versions 11.0.0.beta2 through 11.0.1

Description The issue is related to the webapps directory in Eclipse Jetty being a symlink, which can cause the contents of the webapps directory to be deployed as a static webapp. This can inadvertently serve the webapps themselves and anything else that might be in that directory, potentially allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For Eclipse Jetty versions 9.4.32 through 9.4.38, do not use a symlink for the webapps directory. For Eclipse Jetty versions 10.0.0.beta2 through 10.0.1, do not use a symlink for the webapps directory. For Eclipse Jetty versions 11.0.0.beta2 through 11.0.1, do not use a symlink for the webapps directory.

Exploit

Fix

Information Disclosure

Link Following

Weakness Enumeration

CWE-200

CWE-59

Related Identifiers

ALT-PU-2021-2000

BDU:2022-05511

BIT-SOLR-2021-28163

CVE-2021-28163

GHSA-J6QJ-J888-VVGQ

OPENSUSE-SU-2021:2005-1

OPENSUSE-SU-2021_2005-1

OPENSUSE-SU-2024:10878-1

RHSA-2021:1509

RHSA-2021:1551

SUSE-SU-2021:2005-1

SUSE-SU-2021_2005-1

Affected Products

Alt Linux

Eclipse Jetty

Suse

References · 83

• 🔥 https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2005-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20211206.4.pdf · Security Note
• https://osv.dev/vulnerability/BIT-solr-2021-28163 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28163 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28163 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28163 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05511 · Security Note
• https://osv.dev/vulnerability/GHSA-j6qj-j888-vvgq · Vendor Advisory