ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2021-28163

PoC —
CVSS 3.1
2.7 low
EPSS
4%p90
Published
()
Modified
Description

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Vendors
eclipsefedoraprojectapachenetapporacle
Products
jetty, fedora, ignite, solr, cloud manager, e-series performance analyzer, e-series santricity os controller, e-series santricity web services, element plug-in for vcenter server, santricity cloud connector, snapcenter, snapcenter plug-in
Weakness
CWE-200, CWE-59
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (4.2%)

In the news

No ingested article mentions this CVE yet.