4

CVE-2021-28163

Exploit

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Data is provided by the National Vulnerability Database (NVD)
Eclipse ≫ Jetty Version >= 9.4.32 < 9.4.39
Eclipse ≫ Jetty Version10.0.0 Updatebeta2
Eclipse ≫ Jetty Version10.0.1
Eclipse ≫ Jetty Version11.0.0 Update-
Eclipse ≫ Jetty Version11.0.0 Updatebeta2
Eclipse ≫ Jetty Version11.0.0 Updatebeta3
Eclipse ≫ Jetty Version11.0.1
Fedoraproject ≫ Fedora Version32
Fedoraproject ≫ Fedora Version33
Fedoraproject ≫ Fedora Version34
Apache ≫ Ignite Version < 2.1.1
Apache ≫ Solr Version8.8.1
Netapp ≫ Cloud Manager Version-
Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.70.1
Netapp ≫ E-series Santricity Web Services Version- SwPlatformweb_services_proxy
Netapp ≫ Snapcenter Version-
Netapp ≫ Snapcenter Plug-in Version- SwPlatformvmware_vsphere
Netapp ≫ Storage Replication Adapter For Clustered Data Ontap SwPlatformvmware_vsphere Version >= 9.6
Netapp ≫ Virtual Storage Console SwPlatformvmware_vsphere Version >= 9.6
Oracle ≫ Banking Apis Version20.1
Oracle ≫ Banking Apis Version21.1
Oracle ≫ Communications Session Report Manager Version >= 8.0.0 <= 8.2.4.0
Oracle ≫ Communications Session Route Manager Version >= 8.0.0 <= 8.2.4.0
Oracle ≫ Siebel Core - Automation Version <= 21.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.21% 0.436
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
emo@eclipse.org 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://www.oracle.com/security-alerts/cpuapr2022.html
Third Party Advisory
Not Applicable