Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.eclipse.jetty:jetty-deploy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.7MavenPublished

    Directory exposure in jetty

    CVE-2021-28163 · GHSA-j6qj-j888-vvgq

    Affected
    • Maven org.eclipse.jetty:jetty-deploy >= 9.4.32, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2
    Fixed in
    9.4.3911.0.210.0.2· Vendor fix available
    Issue
    Impact If the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink (soft link in Linux), the contents of the ${jetty.base}/webapps directory may be deployed as a static web application, exposing the content of the directory for download. For example, the problem manifests in the following ${jetty.base}: Workarounds Do not use a symlink

    Recommended action: Upgrade to 11.0.2, 10.0.2 or 9.4.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →