CVE-2021-28163

2.7 lowEPSS 4.2%

Low (2.7). EPSS 4.2% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-deploy 10.0.2, 11.0.2, 9.4.39.

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS: 4.2% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWEs: CWE-59, CWE-200
Published: 2021-04-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:ignite
apache:solr
eclipse:jetty
fedoraproject:fedora
netapp:cloud_manager
netapp:e-series_performance_analyzer
netapp:e-series_santricity_os_controller
netapp:e-series_santricity_web_services
netapp:element_plug-in_for_vcenter_server
netapp:santricity_cloud_connector
netapp:snapcenter
netapp:snapcenter_plug-in
netapp:storage_replication_adapter_for_clustered_data_ontap
netapp:vasa_provider_for_clustered_data_ontap
netapp:virtual_storage_console
oracle:autovue_for_agile_product_lifecycle_management
oracle:banking_apis
oracle:banking_digital_experience
oracle:communications_element_manager
oracle:communications_services_gatekeeper
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:siebel_core_-_automation

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-j6qj-j888-vvgq	Maven	org.eclipse.jetty:jetty-deploy	>=9.4.32 <9.4.39	9.4.39
GHSA-j6qj-j888-vvgq	Maven	org.eclipse.jetty:jetty-deploy	>=10.0.0 <10.0.2	10.0.2
GHSA-j6qj-j888-vvgq	Maven	org.eclipse.jetty:jetty-deploy	>=11.0.0 <11.0.2	11.0.2

References

Check your stack JSON