VYPR
← All advisories
Low severityNVD Advisory· Published Apr 1, 2021· Updated Aug 3, 2024

CVE-2021-28163

CVE-2021-28163

Description

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jetty incorrectly serves webapps directory contents when the webapps path is a symlink, potentially exposing sensitive files.

Vulnerability

In Eclipse Jetty versions 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if the webapps directory is a symlink, its target contents are deployed as a static webapp, inadvertently serving the webapps themselves and any other files in that directory [1].

Exploitation

An attacker with network access to the Jetty server can send HTTP requests to the server, which will respond with files from the symlinked directory. No authentication is required if the server is exposed. The attacker simply navigates to the URL path corresponding to the static webapp to retrieve files [1].

Impact

Successful exploitation leads to information disclosure, potentially exposing web application archives, source code, configuration files, or other sensitive data stored in the webapps directory [1].

Mitigation

The available references do not specify a fixed version. Users should upgrade to the latest Jetty version outside the affected ranges or avoid using symlinks for the webapps directory. Monitor the Jetty project and Fedora package announcements for updates [1].

References
  1. NVD - CVE-2021-28163

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-deployMaven
>= 9.4.32, < 9.4.399.4.39
org.eclipse.jetty:jetty-deployMaven
>= 10.0.0, < 10.0.210.0.2
org.eclipse.jetty:jetty-deployMaven
>= 11.0.0, < 11.0.211.0.2

Affected products

7

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

50

News mentions

0

No linked articles in our index yet.