NetSight
IP …
low2.7

CVE-2021-28163

Directory exposure in jetty

Impact

### Impact If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. For example, the problem manifests in the following `${jetty.base}`: ```$ tree demo-base/ demo-base/ ├── etc ├── lib ├── resources ├── start.d ├── deploy │   └── async-rest.war └── webapps -> deploy ``` ### Workarounds Do not use a symlink

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.eclipse.jetty:jetty-deploy>= 9.4.32, < 9.4.399.4.39

Affected products

VendorProductAffected versions
EclipseJetty
from 9.4.32 before 9.4.39
Versions 10.0.0, 10.0.1, 11.0.0, 11.0.1
FedoraprojectFedora
Versions 32, 33, 34
ApacheIgnite
before 2.1.1
ApacheSolr
Version 8.8.1
NetappCloud Manager
All versions
NetappE-Series Performance Analyzer
All versions
NetappE-Series Santricity Os Controller
from 11.0.0 through 11.70.1
NetappE-Series Santricity Web Services
All versions
NetappElement Plug-In For Vcenter Server
All versions
NetappSantricity Cloud Connector
All versions
NetappSnapcenter
All versions
NetappSnapcenter Plug-In
All versions

Weakness classification

CWE-200CWE-59

References