CVE-2021-28163

🗓️ 01 Apr 2021 14:20:13Reported by eclipseType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 422 Views

Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1 allows symlink for webapps directory leading to unintended access

Reporter	Title	Published	Views	Family All 93
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues	24 Jun 202216:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM InfoSphere Information Server	17 May 202302:32	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	29 Mar 202206:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM Installation Manager and IBM Packaging Utility	24 Jun 202116:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Mobile Enterprise Gateway uses Eclipse Jetty with multiple known vulnerabilities	6 Jun 202218:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	3 Dec 202118:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	29 Jun 202123:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Rational Change 5.3.2 Fix Pack 04 and earlier versions.	11 Oct 202208:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eclipse Jetty affect Rational Performance Tester (CVE-2021-28169, CVE-2021-34428, CVE-2021-28163, CVE-2021-28164, CVE-2021-34429, CVE-2021-28165)	29 Jul 202220:31	–	ibm
IBM Security Bulletins	Security Bulletin: Common vulnerabilities fixed in Cloudera Data Platform 7.1.9 HF2	7 May 202419:54	–	ibm

NVD

Node

eclipse jettyRange9.4.32–9.4.39

eclipse jettyMatch10.0.0beta2

eclipse jettyMatch10.0.1

eclipse jettyMatch11.0.0-

eclipse jettyMatch11.0.0beta2

eclipse jettyMatch11.0.0beta3

eclipse jettyMatch11.0.1

Node

fedoraproject fedoraMatch32

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

Node

apache igniteRange<2.1.1

apache solrMatch8.8.1

Node

netapp cloud_managerMatch-

netapp e-series_performance_analyzerMatch-

netapp e-series_santricity_os_controllerRange11.0.0–11.70.1

netapp e-series_santricity_web_servicesMatch-web_services_proxy

netapp element_plug-in_for_vcenter_serverMatch-

netapp santricity_cloud_connectorMatch-

netapp snapcenterMatch-

netapp snapcenter_plug-inMatch-vmware_vsphere

netapp storage_replication_adapter_for_clustered_data_ontapRange9.6≥vmware_vsphere

netapp vasa_provider_for_clustered_data_ontapRange9.6≥

netapp virtual_storage_consoleRange9.6≥vmware_vsphere

Node

oracle autovue_for_agile_product_lifecycle_managementMatch21.0.2

oracle banking_apisMatch20.1

oracle banking_apisMatch21.1

oracle banking_digital_experienceMatch20.1

oracle banking_digital_experienceMatch21.1

oracle communications_element_managerMatch8.2.2

oracle communications_services_gatekeeperMatch7.0

oracle communications_session_report_managerRange8.0.0–8.2.4.0

oracle communications_session_route_managerRange8.0.0–8.2.4.0

oracle siebel_core_-_automationRange≤21.9

[
  {
    "product": "Eclipse Jetty",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.4.32",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.4.38",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "10.0.0.beta2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "11.0.0.beta2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "11.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3E
lists	www.lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E
lists	www.lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E
lists	www.lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAAKW7S66TECXGJZWB3ZFGOQAK34IYHF/
lists	www.lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E

21 Nov 2024 05:59Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.12.7

CVSS 24

EPSS0.00154

cve-2021-28163 eclipse jetty web security symlink vulnerability