Information disclosure in Apache Ignite
CVE-2021-28163
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.042 (90.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 90.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.042 · newest: 0.042 · change: 0.000
Affected products
- Apache Ignite
- Apache Solr — versions 8.8.1
- Eclipse Jetty — versions 10.0.0, 10.0.1, 11.0.0
- NetApp Cloud Manager
- NetApp Element Plug-In For Vcenter Server
- NetApp E-Series Performance Analyzer
- NetApp E-Series Santricity OS Controller
- NetApp E-Series Santricity Web Services
- NetApp Santricity Cloud Connector
- NetApp Snapcenter
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq (Exploit, Third Party Advisory)
- lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5… (mailing-list)
- lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8c… (mailing-list)
- lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405e… (mailing-list)
- lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47… (mailing-list)
- lists.apache.org/thread.html/r787e47297a614b05b99d01b04c8a1d6c0cafb480c9cb7c624… (mailing-list)
- lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd2… (mailing-list)
- lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e9… (mailing-list)
- lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc4… (mailing-list)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2021-28163?
- CVE-2021-28163 is a low-severity vulnerability in Apache Ignite, classified under Information Disclosure. CVSS score: 2.7/10. Published 2021-04-01.
- How severe is CVE-2021-28163?
- Low severity. CVSS v3 base score is 2.7 out of 10.
- Is CVE-2021-28163 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.