VYPR
← All advisories
High severityNVD Advisory· Published Oct 23, 2020· Updated Aug 4, 2024

CVE-2020-27216

CVE-2020-27216

Description

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Eclipse Jetty on Unix-like systems suffers from a local privilege escalation via a race condition during temporary directory creation, allowing collocated attackers to hijack web application resources.

Root

Cause

CVE-2020-27216 affects Eclipse Jetty versions up to 9.4.32.v20200930, 10.0.0.beta2, and 11.0.0.beta2 on Unix-like systems [1]. The vulnerability stems from the use of the system's shared temporary directory (/tmp) when creating subdirectories for unpacking web applications. This directory is readable and writable by all local users, creating a race condition window between the creation of the temporary subdirectory by Jetty and an attacker [2][3]. The underlying weakness aligns with CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) and CWE-378 (Creation of Temporary File With Insecure Permissions) [2][3].

Attack

Vector

A collocated user (i.e., another user on the same machine) can monitor the filesystem for the creation of a temporary directory by Jetty and attempt to win a race to create that subdirectory before Jetty completes its own creation process [1][4]. If the attacker succeeds, the attacker becomes the owner of the directory, thereby obtaining both read and write permissions to it. This directory is subsequently used by Jetty to unpack deployed web applications, including their WEB-INF/lib JAR files and JSP files [1]. Any user code that accesses WebAppContext::getTempDirectory or the Servlet context attribute for javax.servlet.ServletContext.TEMPDIR is also impacted [4].

Impact

Successful exploitation gives the attacker full control over the unpacked web application artifacts [1]. If a JAR or JSP file stored in that directory is later executed (e.g., during application runtime), the attacker can inject malicious code into the application, leading to local privilege escalation [1][4]. The attacker effectively gains the ability to execute arbitrary code in the context of the Jetty server or the hosted application.

Mitigation

The vulnerability is patched in Jetty versions 9.4.33.v20201013, 10.0.0.beta3, and 11.0.0.beta3 [1]. Users should upgrade to these or later releases. No full workaround exists for older versions; administrators can mitigate risk by ensuring that the system temporary directory has restricted permissions or by mounting it on a filesystem that prevents symlink races, but the recommended action is to apply the vendor-provided fix.

References
  1. NVD - CVE-2020-27216
  2. CWE-379: Creation of Temporary File in Directory with Insecure Permissions (4.20)
  3. CWE-378: Creation of Temporary File With Insecure Permissions (4.20)
  4. 567921 – (CVE-2020-27216) Jetty vulnerable to temporary directory hijacking

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-webappMaven
< 9.4.33.v202010209.4.33.v20201020
org.mortbay.jetty:jetty-webappMaven
< 9.4.339.4.33
org.eclipse.jetty:jetty-webappMaven
>= 10.0.0.beta1, < 10.0.0.beta310.0.0.beta3
org.mortbay.jetty:jetty-webappMaven
>= 10.0.0.beta1, < 10.0.0.beta310.0.0.beta3
org.eclipse.jetty:jetty-webappMaven
>= 11.0.0.beta1, < 11.0.0.beta311.0.0.beta3
org.mortbay.jetty:jetty-webappMaven
>= 11.0.0.beta1, < 11.0.0.beta311.0.0.beta3

Affected products

5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

278

News mentions

0

No linked articles in our index yet.