~ / search / GHSA-j6qj-j888-vvgq

GHSA-j6qj-j888-vvgq

Directory exposure in jetty

Source: GitHub Advisory Database (reviewed) Low CVE-2021-28163

Packages

EcosystemPackageAffectedFixed in
Maven org.eclipse.jetty:jetty-deploy >= 9.4.32, < 9.4.39 9.4.39
Maven org.eclipse.jetty:jetty-deploy >= 10.0.0, < 10.0.2 10.0.2
Maven org.eclipse.jetty:jetty-deploy >= 11.0.0, < 11.0.2 11.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. For example, the problem manifests in the following `${jetty.base}`: ```$ tree demo-base/ demo-base/ ├── etc ├── lib ├── resources ├── start.d ├── deploy │   └── async-rest.war └── webapps -> deploy ``` ### Workarounds Do not use a symlink

References

External links from the advisory. They lead to third-party sites.