CVE-2021-28163: Infoleak

First published: Thu Apr 01 2021(Updated: )

Eclipse Jetty could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain webapp directory contents information, and use this information to launch further attacks against the affected system.

Credit: emo@eclipse.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• agent/type
• agent/first-publish-date
• agent/remedy
• agent/last-modified-date
• agent/author
• agent/weakness
• agent/severity
• agent/references
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2021-28163
• agent/software-canonical-lookup
• agent/event
• agent/description
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/softwarecombine
• collector/ibm-support
• source/IBM
• agent/tags
• collector/mitre-cve
• source/MITRE
• package-manager/redhat
• vendor/eclipse
• canonical/eclipse jetty
• version/eclipse jetty/9.4.32
• version/eclipse jetty/10.0.0-beta2
• version/eclipse jetty/10.0.1
• version/eclipse jetty/11.0.0
• version/eclipse jetty/11.0.0-beta2
• version/eclipse jetty/11.0.0-beta3
• version/eclipse jetty/11.0.1
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/32
• version/fedoraproject fedora/33
• version/fedoraproject fedora/34
• vendor/apache
• canonical/apache ignite
• canonical/apache solr
• version/apache solr/8.8.1
• vendor/netapp
• canonical/netapp cloud manager
• canonical/netapp e-series performance analyzer
• canonical/netapp e-series santricity os controller
• version/netapp e-series santricity os controller/11.0.0
• version/netapp e-series santricity os controller/11.70.1
• canonical/netapp e-series santricity web services web services proxy
• canonical/netapp element plug-in for vcenter server
• canonical/netapp santricity cloud connector
• canonical/netapp snapcenter
• canonical/netapp snapcenter plug-in vmware vsphere
• canonical/netapp storage replication adapter for clustered data ontap vmware vsphere
• version/netapp storage replication adapter for clustered data ontap vmware vsphere/9.6
• canonical/netapp vasa provider for clustered data ontap
• version/netapp vasa provider for clustered data ontap/9.6
• canonical/netapp virtual storage console vmware vsphere
• version/netapp virtual storage console vmware vsphere/9.6
• vendor/oracle
• canonical/oracle autovue for agile product lifecycle management
• version/oracle autovue for agile product lifecycle management/21.0.2
• canonical/oracle banking apis
• version/oracle banking apis/20.1
• version/oracle banking apis/21.1
• canonical/oracle banking digital experience
• version/oracle banking digital experience/20.1
• version/oracle banking digital experience/21.1
• canonical/oracle communications element manager
• version/oracle communications element manager/8.2.2
• canonical/oracle communications services gatekeeper
• version/oracle communications services gatekeeper/7.0
• canonical/oracle communications session report manager
• version/oracle communications session report manager/8.0.0
• version/oracle communications session report manager/8.2.4.0
• canonical/oracle communications session route manager
• version/oracle communications session route manager/8.0.0
• version/oracle communications session route manager/8.2.4.0
• canonical/oracle siebel core - automation
• version/oracle siebel core - automation/21.9