{"id":"CVE-2021-28163","aliases":["BIT-solr-2021-28163","DEBIAN-CVE-2021-28163","EUVD-2021-0837","GHSA-j6qj-j888-vvgq","RHSA-2021:1509","RHSA-2021:1551","SUSE-SU-2021:2005-1","UBUNTU-CVE-2021-28163","openSUSE-SU-2021:2005-1","openSUSE-SU-2024:10878-1"],"status":"published","title":"Directory exposure in jetty","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0418,"percentile":0.91055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-59"],"published":"2021-04-01T14:20:13Z","modified":"2026-10-24T10:50:12Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","fixed_in":["9.4.39","10.0.2","11.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"solr","fixed_in":["8.8.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jetty9","fixed_in":["9.4.39-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jetty9","fixed_in":["9.4.39-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty9","fixed_in":["9.4.39-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.32"},{"fixed":"9.4.39"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"solr","ranges":[{"type":"SEMVER","events":[{"introduced":"8.8.1"},{"fixed":"8.8.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.32"},{"fixed":"9.4.39"}]}],"versions":["9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.2"}]}],"versions":["10.0.0","10.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-deploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.2"}]}],"versions":["11.0.0","11.0.1"]},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-continuation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-jaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-util-ajax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"rh-eclipse-jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.4.40-1.1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.0-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.0-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-95.rhaos4.8.gitcd80260.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-95.rhaos4.8.gitcd80260.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.0-2.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.0-2.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.0-2.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-95.rhaos4.8.gitcd80260.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-95.rhaos4.8.gitcd80260.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-95.rhaos4.8.gitcd80260.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.277.3.1620393611-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.42-3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.42-3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"equinox-bundles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"equinox-bundles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12-1","4.13-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"equinox-bundles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18-1","4.19-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.42-3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"jetty-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.42-3.9.1"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"ignite"},{"vendor":"apache","product":"solr"},{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"cloud_manager"},{"vendor":"netapp","product":"e-series_performance_analyzer"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_web_services"},{"vendor":"netapp","product":"element_plug-in_for_vcenter_server"},{"vendor":"netapp","product":"santricity_cloud_connector"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"netapp","product":"snapcenter_plug-in"},{"vendor":"netapp","product":"storage_replication_adapter_for_clustered_data_ontap"},{"vendor":"netapp","product":"vasa_provider_for_clustered_data_ontap"},{"vendor":"netapp","product":"virtual_storage_console"},{"vendor":"oracle","product":"autovue_for_agile_product_lifecycle_management"},{"vendor":"oracle","product":"banking_apis"},{"vendor":"oracle","product":"banking_digital_experience"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_services_gatekeeper"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"siebel_core_-_automation"},{"vendor":"the eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web","article","report"]},{"url":"https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r787e47297a614b05b99d01b04c8a1d6c0cafb480c9cb7c624a6b8fc3%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210611-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28163","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b@%3Cissues.ignite.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e@%3Cdev.ignite.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r787e47297a614b05b99d01b04c8a1d6c0cafb480c9cb7c624a6b8fc3@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f@%3Cissues.ignite.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46@%3Cissues.ignite.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd@%3Cissues.ignite.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS/"},{"url":"https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c@%3Cissues.solr.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j6qj-j888-vvgq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28163","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210611-0006","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGNKXBNRRCZTGGXPIX3VBWCF2SAM3DWS","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5CXQIJVYU4R3JL6LSPXQ5GIV7WLLA7PI","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1509","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_eclipse_4.19/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945714","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1509.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28163","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28163","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28164","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28165","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28165","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1551","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959660","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1551.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/mperVMGa98w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21639","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21640","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184366","tags":["report"]},{"url":"https://bugzilla.suse.com/1184367","tags":["report"]},{"url":"https://bugzilla.suse.com/1184368","tags":["report"]},{"url":"https://bugzilla.suse.com/1187117","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28169","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-28163","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4KKN3NUA6VAZ6XTFLI3KB3IHAPVD46L/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34429","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28163","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2021-04-01T14:20:13Z","modified":"2024-08-03T21:40:12.28Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-0837","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2021-04-01T14:20:13Z","modified":"2024-08-03T21:40:12Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T03:24:47.350261Z"}],"ghsa":[{"id":"GHSA-j6qj-j888-vvgq","title":"Directory exposure in jetty","description":"### Impact\nIf the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. \n\nFor example, the problem manifests in the following `${jetty.base}`:\n```$ tree demo-base/\ndemo-base/\n├── etc\n├── lib\n├── resources\n├── start.d\n├── deploy\n│   └── async-rest.war\n└── webapps -\u003e deploy\n\n``` \n\n### Workarounds\nDo not use a symlink","status":"published","published":"2021-04-06T17:32:00Z","modified":"2023-02-01T05:05:13Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-59","CWE-200"],"updated_at":"2026-11-02T14:36:33.613868Z"}],"nvd":[{"id":"CVE-2021-28163","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2021-04-01T15:15:14.08Z","modified":"2026-06-17T03:45:54.48Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-59"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"CVE-2021-28163","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2021-04-01T15:15:14.08Z","modified":"2026-10-24T10:50:12.006928442Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28163","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2021-04-01T15:15:14.08Z","modified":"2026-10-23T18:04:49.71931237Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-j6qj-j888-vvgq","title":"Directory exposure in jetty","description":"### Impact\nIf the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. \n\nFor example, the problem manifests in the following `${jetty.base}`:\n```$ tree demo-base/\ndemo-base/\n├── etc\n├── lib\n├── resources\n├── start.d\n├── deploy\n│   └── async-rest.war\n└── webapps -\u003e deploy\n\n``` \n\n### Workarounds\nDo not use a symlink","status":"published","published":"2021-04-06T17:32:00Z","modified":"2026-07-08T06:29:08.441823034Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-59"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"RHSA-2021:1509","title":"Red Hat Security Advisory: rh-eclipse-jetty security update","status":"published","published":"2024-09-29T18:05:55Z","modified":"2026-10-13T10:02:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1551","title":"Red Hat Security Advisory: OpenShift Container Platform 4.7.11 security and bug fix update","status":"published","published":"2024-09-29T18:06:11Z","modified":"2026-10-13T10:02:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2021-28163","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2021-04-01T15:15:00Z","modified":"2025-10-24T04:50:13Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"BIT-solr-2021-28163","description":"In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.","status":"published","published":"2024-03-06T11:06:40.498Z","modified":"2026-09-08T08:48:19.451749942Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"openSUSE-SU-2021:2005-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\nUpdate to version 9.4.42.v20210604\n\n- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory\n- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length \u003e 17408\n- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs\n- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan\n","status":"published","published":"2021-07-11T08:05:38Z","modified":"2026-02-04T03:49:18.354753Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10878-1","title":"jetty-annotations-9.4.43-1.2 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.43-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:44:09.055501Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:2005-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\nUpdate to version 9.4.42.v20210604\n\n- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory\n- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length \u003e 17408\n- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs\n- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan\n","status":"published","published":"2021-06-17T16:04:19Z","modified":"2026-02-04T02:34:06.668433Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}