CVE-2021-28163: apache ignite
Vulnerability summary
CVE-2021-28163 is a medium (CVSS 4.0) vulnerability in apache ignite. EPSS estimates a 4.18% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 01-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
4.18%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJetty.Project
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-59Improper Link Resolution Before File AccessThe product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp11 products
- cloud_managerna
- e-series_performance_analyzerna
- e-series_santricity_os_controller≥ 11.0.0, ≤ 11.70.1
- e-series_santricity_web_servicesna
- element_plug-in_for_vcenter_serverna
Oracle8 products
- autovue_for_agile_product_lifecycle_management21.0.2
- banking_apis20.1 | 21.1
- banking_digital_experience20.1 | 21.1
- communications_element_manager8.2.2
- communications_services_gatekeeper7.0
Debian1 product
- jetty9< 9.4.39-1
Eclipse1 product
- jettyEOL≥ 9.4.32, < 9.4.39 | 10.0.0:beta2 | 10.0.1 | 11.0.0 | 11.0.0:beta2 | 11.0.0:beta3 | 11.0.1
Fedoraproject1 product
- fedoraEOL32 | 33 | 34
Org.eclipse.jetty1 product
- jetty-deploy≥ 9.4.32, < 9.4.39 | ≥ 10.0.0, < 10.0.2 | ≥ 11.0.0, < 11.0.2
The eclipse foundation1 product
- eclipse jetty≥ 9.4.32, < unspecified | ≥ unspecified, ≤ 9.4.38 | ≥ 10.0.0.beta2, < unspecified | ≥ unspecified, ≤ 10.0.1 | ≥ 11.0.0.beta2, < unspecified | ≥ unspecified, ≤ 11.0.1
Ubuntu1 product
- equinox-bundlesAll versions (No fix recorded)
9 vendors · 27 products
References
53 links- github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgqX Refsource CONFIRMREPORTWEBExploitThird Party Advisory
Show all 53 references
- lists.apache.org/thread.html/…X Refsource MISC
- lists.apache.org/thread.html/…X Refsource MISC
