CVE-2020-27216
jetty: local temporary directory hijacking vulnerability
Severity Score
7.0
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
En Eclipse Jetty versiones 1.0 hasta 9.4.32.v20200930, versiones 10.0.0.alpha1 hasta 10.0.0.beta2 y versiones 11.0.0.alpha1 hasta 11.0.0.beta2O, en sistemas similares a Unix, el directorio temporal del sistema es compartido entre todos los usuarios en ese sistema. Un usuario colocado puede observar el proceso de creación de un subdirectorio temporal en el directorio temporal compartido y correr para completar la creación del subdirectorio temporal. Si el atacante gana la carrera, tendrá permiso de lectura y escritura en el subdirectorio usado para descomprimir las aplicaciones web, incluyendo sus archivos jar WEB-INF/lib y archivos JSP. Si alguna vez es ejecutado algún código fuera de este directorio temporal, esto puede conllevar a una vulnerabilidad de escalada de privilegios local
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-10-19 CVE Reserved
- 2020-10-23 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-377: Insecure Temporary File
- CWE-378: Creation of Temporary File With Insecure Permissions
- CWE-379: Creation of Temporary File in Directory with Insecure Permissions
CAPEC
References (142)
| URL | Date | SRC |
|---|---|---|
| https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921 | 2024-08-04 | |
| https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://www.oracle.com//security-alerts/cpujul2021.html | 2023-11-07 | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | 2023-11-07 | |
| https://www.oracle.com/security-alerts/cpujan2021.html | 2023-11-07 | |
| https://www.oracle.com/security-alerts/cpuoct2021.html | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2021/dsa-4949 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2020-27216 | 2021-08-11 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1891132 | 2021-08-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Netapp Search vendor "Netapp" | Storage Replication Adapter Search vendor "Netapp" for product "Storage Replication Adapter" | >= 7.2 Search vendor "Netapp" for product "Storage Replication Adapter" and version " >= 7.2" | clustered_data_ontap |
Affected
| in | Vmware Search vendor "Vmware" | Vsphere Search vendor "Vmware" for product "Vsphere" | - | - |
Safe
|
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | >= 1.0 < 9.3.29 Search vendor "Eclipse" for product "Jetty" and version " >= 1.0 < 9.3.29" | - |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | >= 9.4.0 <= 9.4.32 Search vendor "Eclipse" for product "Jetty" and version " >= 9.4.0 <= 9.4.32" | - |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 10.0.0 Search vendor "Eclipse" for product "Jetty" and version "10.0.0" | alpha1 |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 10.0.0 Search vendor "Eclipse" for product "Jetty" and version "10.0.0" | beta0 |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 10.0.0 Search vendor "Eclipse" for product "Jetty" and version "10.0.0" | beta1 |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 10.0.0 Search vendor "Eclipse" for product "Jetty" and version "10.0.0" | beta2 |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 11.0.0 Search vendor "Eclipse" for product "Jetty" and version "11.0.0" | alpha1 |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 11.0.0 Search vendor "Eclipse" for product "Jetty" and version "11.0.0" | beta1 |
Affected
| ||||||
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 11.0.0 Search vendor "Eclipse" for product "Jetty" and version "11.0.0" | beta2 |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snap Creator Framework Search vendor "Netapp" for product "Snap Creator Framework" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snapcenter Search vendor "Netapp" for product "Snapcenter" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Vasa Provider Search vendor "Netapp" for product "Vasa Provider" | >= 7.2 Search vendor "Netapp" for product "Vasa Provider" and version " >= 7.2" | clustered_data_ontap |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Virtual Storage Console Search vendor "Netapp" for product "Virtual Storage Console" | >= 7.2 Search vendor "Netapp" for product "Virtual Storage Console" and version " >= 7.2" | vmware_vsphere |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Application Session Controller Search vendor "Oracle" for product "Communications Application Session Controller" | 3.9m0p2 Search vendor "Oracle" for product "Communications Application Session Controller" and version "3.9m0p2" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Converged Application Server - Service Controller Search vendor "Oracle" for product "Communications Converged Application Server - Service Controller" | 6.2 Search vendor "Oracle" for product "Communications Converged Application Server - Service Controller" and version "6.2" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager" | >= 8.2.1 <= 8.2.2.1 Search vendor "Oracle" for product "Communications Element Manager" and version " >= 8.2.1 <= 8.2.2.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Offline Mediation Controller Search vendor "Oracle" for product "Communications Offline Mediation Controller" | 12.0.0.3.0 Search vendor "Oracle" for product "Communications Offline Mediation Controller" and version "12.0.0.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Pricing Design Center Search vendor "Oracle" for product "Communications Pricing Design Center" | 12.0.0.3.0 Search vendor "Oracle" for product "Communications Pricing Design Center" and version "12.0.0.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper" | 7.0 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version "7.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Core Banking Search vendor "Oracle" for product "Flexcube Core Banking" | >= 11.5.0 <= 11.9.0 Search vendor "Oracle" for product "Flexcube Core Banking" and version " >= 11.5.0 <= 11.9.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking" | 12.0.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking" | 12.1.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.1.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jd Edwards Enterpriseone Tools Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" | < 9.2.6.0 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version " < 9.2.6.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Siebel Core - Automation Search vendor "Oracle" for product "Siebel Core - Automation" | <= 21.5 Search vendor "Oracle" for product "Siebel Core - Automation" and version " <= 21.5" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Beam Search vendor "Apache" for product "Beam" | 2.21.0 Search vendor "Apache" for product "Beam" and version "2.21.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Beam Search vendor "Apache" for product "Beam" | 2.22.0 Search vendor "Apache" for product "Beam" and version "2.22.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Beam Search vendor "Apache" for product "Beam" | 2.23.0 Search vendor "Apache" for product "Beam" and version "2.23.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Beam Search vendor "Apache" for product "Beam" | 2.24.0 Search vendor "Apache" for product "Beam" and version "2.24.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Beam Search vendor "Apache" for product "Beam" | 2.25.0 Search vendor "Apache" for product "Beam" and version "2.25.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||