Most recent entries from all

bdu:2022-05511

BIT-solr-2021-28163

Affected: Bitnami: solr

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

certfr-2021-avi-912 — De multiples vulnérabilités ont été découvertes dans IBM Qradar. Certaines d'entre elles permettent à un attaquant de p…

certfr-2021-avi-912

cnvd-2021-27376

EUVD-2026-25879

fkie_cve-2021-28163

GHSA-j6qj-j888-vvgq — Directory exposure in jetty

Affected: Maven: org.eclipse.jetty:jetty-deploy

### Impact If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download.

For example, the problem manifests in the following `${jetty.base}`: ```$ tree demo-base/ demo-base/ ├── etc ├── lib ├── resources ├── start.d ├── deploy │ └── async-rest.war └── webapps -> deploy

```

### Workarounds Do not use a symlink

gsd-2021-28163

openSUSE-SU-2021:2005-1 — Security update for jetty-minimal

Security update for jetty-minimal

RHSA-2021:1509 — Red Hat Security Advisory: rh-eclipse-jetty security update

jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame

SUSE-SU-2021:2005-1 — Security update for jetty-minimal

Security update for jetty-minimal

UBUNTU-CVE-2021-28163

Affected: Ubuntu:18.04:LTS: equinox-bundles, Ubuntu:20.04:LTS: equinox-bundles, Ubuntu:22.04:LTS: equinox-bundles

WID-SEC-W-2022-1365 — Eclipse Jetty: Mehrere Schwachstellen

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand auszulösen.