Versio.io

CVE-2021-28163

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 01-04-2021 05:15
Last modified: - 12-05-2022 04:36
Total changes: - 21

Description

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Low
Attack complexity
Network
Attack vector
None
Availability
Low
Confidentiality
None
Integrity
High
Privileges required
Unchanged
Scope
None
User interaction
2.7
Base score
1.2
1.4
Exploitability score
Impact score
 

Verification logic

OR
OR
vendor=eclipse AND product=jetty AND version=11.0.0 AND update=beta2
vendor=eclipse AND product=jetty AND version=10.0.0 AND update=beta2
vendor=eclipse AND product=jetty AND version=11.0.0 AND update=-
vendor=eclipse AND product=jetty AND version=11.0.1
vendor=eclipse AND product=jetty AND version=11.0.0 AND update=beta3
vendor=eclipse AND product=jetty AND version=10.0.1
vendor=eclipse AND product=jetty AND versionStartIncluding=9.4.32 AND versionEndExcluding=9.4.39
OR
vendor=fedoraproject AND product=fedora AND version=32
vendor=fedoraproject AND product=fedora AND version=33
vendor=fedoraproject AND product=fedora AND version=34
OR
vendor=apache AND product=solr AND version=8.8.1
vendor=apache AND product=ignite AND versionEndExcluding=2.1.1
OR
vendor=netapp AND product=santricity_cloud_connector AND version=-
vendor=netapp AND product=snapcenter AND version=-
vendor=netapp AND product=e-series_performance_analyzer AND version=-
vendor=netapp AND product=e-series_santricity_web_services AND version=- AND target_software=web_services_proxy
vendor=netapp AND product=virtual_storage_console AND target_software=vmware_vsphere AND versionStartIncluding=9.6
vendor=netapp AND product=storage_replication_adapter_for_clustered_data_ontap AND target_software=vmware_vsphere AND versionStartIncluding=9.6
vendor=netapp AND product=vasa_provider_for_clustered_data_ontap AND versionStartIncluding=9.6
vendor=netapp AND product=cloud_manager AND version=-
vendor=netapp AND product=snapcenter_plug-in AND version=- AND target_software=vmware_vsphere
vendor=netapp AND product=element_plug-in_for_vcenter_server AND version=-
vendor=netapp AND product=e-series_santricity_os_controller AND versionEndIncluding=11.70.1 AND versionStartIncluding=11.0.0
OR
vendor=oracle AND product=banking_digital_experience AND version=20.1
vendor=oracle AND product=communications_services_gatekeeper AND version=7.0
vendor=oracle AND product=autovue_for_agile_product_lifecycle_management AND version=21.0.2
vendor=oracle AND product=siebel_core_-_automation AND versionEndIncluding=21.9
vendor=oracle AND product=communications_session_report_manager AND versionEndIncluding=8.2.4.0 AND versionStartIncluding=8.0.0
vendor=oracle AND product=communications_session_route_manager AND versionEndIncluding=8.2.4.0 AND versionStartIncluding=8.0.0
vendor=oracle AND product=communications_element_manager AND version=8.2.2
vendor=oracle AND product=banking_digital_experience AND version=21.1
vendor=oracle AND product=banking_apis AND version=20.1
vendor=oracle AND product=banking_apis AND version=21.1
 

Reference

 


Keywords

NVD

 

CVE-2021-28163

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.