CVE-2021-28163
Directory exposure in jetty
2.7 LowFix available
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
4.18%Up 3.1 points since Apr 14, 2021
What each source reports
CVE List Score used
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
CVE-2021-28163- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2021-0837
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
EUVD-2021-0837- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j6qj-j888-vvgq
Directory exposure in jetty
Impact
If the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink (soft link in Linux), the contents of the ${jetty.base}/webapps directory may be deployed as a static web application, exposing the content of the directory for download.
For example, the problem manifests in the following ${jetty.base}:
demo-base/
├── etc
├── lib
├── resources
├── start.d
├── deploy
│ └── async-rest.war
└── webapps -> deploy
Workarounds
Do not use a symlink
- Record
GHSA-j6qj-j888-vvgq- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-59, CWE-200
- Updated
- 2026-11-02
NVD
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
CVE-2021-28163- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200, CWE-59
- Updated
- 2026-11-02
OSV
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
CVE-2021-28163- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-28163
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
DEBIAN-CVE-2021-28163- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-j6qj-j888-vvgq
Directory exposure in jetty
Impact
If the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink (soft link in Linux), the contents of the ${jetty.base}/webapps directory may be deployed as a static web application, exposing the content of the directory for download.
For example, the problem manifests in the following ${jetty.base}:
demo-base/
├── etc
├── lib
├── resources
├── start.d
├── deploy
│ └── async-rest.war
└── webapps -> deploy
Workarounds
Do not use a symlink
- Record
GHSA-j6qj-j888-vvgq- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-59
- Updated
- 2026-11-02
OSVRHSA-2021:1509
Red Hat Security Advisory: rh-eclipse-jetty security update
- Record
RHSA-2021:1509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2021:1551
Red Hat Security Advisory: OpenShift Container Platform 4.7.11 security and bug fix update
- Record
RHSA-2021:1551- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-28163
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
UBUNTU-CVE-2021-28163- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-solr-2021-28163 No score
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
- Record
BIT-solr-2021-28163- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2005-1 No score
Security update for jetty-minimal
This update for jetty-minimal fixes the following issues:
Update to version 9.4.42.v20210604
- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory
- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length > 17408
- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan
- Record
openSUSE-SU-2021:2005-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10878-1 No score
jetty-annotations-9.4.43-1.2 on GA media
These are all security issues fixed in the jetty-annotations-9.4.43-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10878-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2005-1 No score
Security update for jetty-minimal
This update for jetty-minimal fixes the following issues:
Update to version 9.4.42.v20210604
- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory
- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length > 17408
- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan
- Record
SUSE-SU-2021:2005-1- Updated
- 2026-11-02
Affected products
- eclipse jetty
- eclipse foundation jetty
- the eclipse foundation eclipse jetty
- apache ignite
- apache solr
- fedoraproject fedora
- netapp cloud manager
- netapp e-series performance analyzer
- netapp e-series santricity os controller
- netapp e-series santricity web services
- netapp element plug-in for vcenter server
- netapp santricity cloud connector
Show 13 moreShow less
- netapp snapcenter
- netapp snapcenter plug-in
- netapp storage replication adapter for clustered data ontap
- netapp vasa provider for clustered data ontap
- netapp virtual storage console
- oracle autovue for agile product lifecycle management
- oracle banking apis
- oracle banking digital experience
- oracle communications element manager
- oracle communications services gatekeeper
- oracle communications session report manager
- oracle communications session route manager
- oracle siebel core - automation
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-deployMaven |
9.4.32 up to 9.4.39 | 9.4.39 |
org.eclipse.jetty:jetty-deployMaven |
10.0.0 up to 10.0.2 | 10.0.2 |
org.eclipse.jetty:jetty-deployMaven |
11.0.0 up to 11.0.2 | 11.0.2 |
solrBitnami |
8.8.1 up to 8.8.2 | 8.8.2 |
jetty9Debian:12 |
before 9.4.39-1 | 9.4.39-1 |
jetty9Debian:13 |
before 9.4.39-1 | 9.4.39-1 |
jetty9Debian:14 |
before 9.4.39-1 | 9.4.39-1 |
org.eclipse.jetty:jetty-deployMaven |
9.4.32 up to 9.4.39, plus listed versions 9.4.32.v202009309.4.33.v202010209.4.34.v202011029.4.35.v202011209.4.36.v202101149.4.37.v202102199.4.38.v20210224 |
9.4.39 |
org.eclipse.jetty:jetty-deployMaven |
10.0.0 up to 10.0.2, plus listed versions 10.0.1 |
10.0.2 |
org.eclipse.jetty:jetty-deployMaven |
11.0.0 up to 11.0.2, plus listed versions 11.0.1 |
11.0.2 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-eclipse-jettyRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-clientRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-continuationRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-httpRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-ioRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-jaasRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-javadocRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-jmxRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-securityRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-serverRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-servletRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-utilRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-util-ajaxRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-webappRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-xmlRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
cri-toolsRed Hat:openshift:4.7::el7 From an advisory covering 6 CVEs |
before 0:1.20.0-2.el7 | 0:1.20.0-2.el7 |
cri-tools-debuginfoRed Hat:openshift:4.7::el7 From an advisory covering 6 CVEs |
before 0:1.20.0-2.el7 | 0:1.20.0-2.el7 |
runcRed Hat:openshift:4.7::el7 From an advisory covering 6 CVEs |
before 0:1.0.0-95.rhaos4.8.gitcd80260.el7 | 0:1.0.0-95.rhaos4.8.gitcd80260.el7 |
runc-debuginfoRed Hat:openshift:4.7::el7 From an advisory covering 6 CVEs |
before 0:1.0.0-95.rhaos4.8.gitcd80260.el7 | 0:1.0.0-95.rhaos4.8.gitcd80260.el7 |
cri-toolsRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:1.20.0-2.el8 | 0:1.20.0-2.el8 |
cri-tools-debuginfoRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:1.20.0-2.el8 | 0:1.20.0-2.el8 |
cri-tools-debugsourceRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:1.20.0-2.el8 | 0:1.20.0-2.el8 |
runcRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:1.0.0-95.rhaos4.8.gitcd80260.el8 | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
runc-debuginfoRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:1.0.0-95.rhaos4.8.gitcd80260.el8 | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
runc-debugsourceRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:1.0.0-95.rhaos4.8.gitcd80260.el8 | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
jenkinsRed Hat:openshift:4.7::el8 From an advisory covering 6 CVEs |
before 0:2.277.3.1620393611-1.el8 | 0:2.277.3.1620393611-1.el8 |
jetty-minimalSUSE:Linux Enterprise Module for Development Tools 15 SP2 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
jetty-minimalSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
equinox-bundlesUbuntu:18.04:LTS |
All versions, plus listed versions 4.9-2~18.04 |
None known |
equinox-bundlesUbuntu:20.04:LTS |
All versions, plus listed versions 4.12-14.13-1 |
None known |
equinox-bundlesUbuntu:22.04:LTS |
All versions, plus listed versions 4.18-14.19-1 |
None known |
jetty-minimalopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
jetty-websocketopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28163 is a low vulnerability (CVSS 2.7) in Eclipse Jetty, published April 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.18%, the 90th percentile. Fixed in org.eclipse.jetty:jetty-deploy 9.4.39.
References
github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq
lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E
Show 96 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF
security.netapp.com/advisory/ntap-20210611-0006
oracle.com/security-alerts/cpuoct2021.html
nvd.nist.gov/vuln/detail/CVE-2021-28163
security-tracker.debian.org/tracker/CVE-2021-28163
access.redhat.com/errata/RHSA-2021:1509
bugzilla.redhat.com/show_bug.cgi?id=1945710
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1509.json
cve.org/CVERecord?id=CVE-2021-28163
groups.google.com/g/golang-announce/c/mperVMGa98w
suse.com/support/update/announcement/2021/suse-su-20212005-1
bugzilla.suse.com/1184366
ubuntu.com/security/CVE-2021-28163
lists.opensuse.org/archives/list/[email protected]/thread/U4KKN3NUA6VAZ6XTFLI3KB3IHAPVD46L