GHSA-j6qj-j888-vvgq

Directory exposure in jetty

En bref

Publiée
Mise à jour
CVE
CVE-2021-28163
Alias
BIT-solr-2021-28163
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

### Impact If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. For example, the problem manifests in the following `${jetty.base}`: ```$ tree demo-base/ demo-base/ ├── etc ├── lib ├── resources ├── start.d ├── deploy │   └── async-rest.war └── webapps -> deploy ``` ### Workarounds Do not use a symlink

Paquets affectés

PaquetVersions
Maven · org.eclipse.jetty:jetty-deployintroduced 9.4.32, fixed 9.4.39
Maven · org.eclipse.jetty:jetty-deployintroduced 10.0.0, fixed 10.0.2
Maven · org.eclipse.jetty:jetty-deployintroduced 11.0.0, fixed 11.0.2

Références

Sources

SourceLicence
OSV.devCC-BY 4.0 — GitHub Advisory Database