CVE-2021-28163
Assigner: eclipse
Published: 2021-04-01T14:20:13
State: PUBLISHED
affected: product: Eclipse Jetty
vendor: The Eclipse Foundation
versions: lessThan: unspecified
status: affected
version: 9.4.32
versionType: custom
lessThanOrEqual: 9.4.38
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: affected
version: 10.0.0.beta2
versionType: custom
lessThanOrEqual: 10.0.1
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: affected
version: 11.0.0.beta2
versionType: custom
lessThanOrEqual: 11.0.1
status: affected
version: unspecified
versionType: custom
descriptions: value: In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-200
description: CWE-200
type: CWE