Read the docs
TI-2020-16542 Aliases CVE-2020-27216GHSA-g3wg-6mcf-8jj6

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and…

Priority LOW 38CWE-378Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 10 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-552.

Summary

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Why it matters now

EPSS 0.04352 91st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial org.eclipse.jetty:jetty-webapp (Maven): 9.4.33.v20201020, 10.0.0.beta3, 11.0.0.beta3org.mortbay.jetty:jetty-webapp (Maven): 9.4.33, 10.0.0.beta3, 11.0.0.beta3Red Hat: 7 advisoriesRed Hat: 10 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty1.0 to 9.4.32.v20200930; 10.0.0.alpha1 to 10.0.0.beta2; 11.0.0.alpha1 to 11.0.0.beta2—No fix listedCNA
—org.eclipse.jetty:jetty-webapp (Maven)before 9.4.33.v202010209.4.33.v20201020Patch availableGHSA-g3wg-6mcf-8jj6
—org.mortbay.jetty:jetty-webapp (Maven)before 9.4.339.4.33Patch availableGHSA-g3wg-6mcf-8jj6
—org.eclipse.jetty:jetty-webapp (Maven)10.0.0.beta1 to before 10.0.0.beta310.0.0.beta3Patch availableGHSA-g3wg-6mcf-8jj6
—org.mortbay.jetty:jetty-webapp (Maven)10.0.0.beta1 to before 10.0.0.beta310.0.0.beta3Patch availableGHSA-g3wg-6mcf-8jj6
—org.eclipse.jetty:jetty-webapp (Maven)11.0.0.beta1 to before 11.0.0.beta311.0.0.beta3Patch availableGHSA-g3wg-6mcf-8jj6
—org.mortbay.jetty:jetty-webapp (Maven)11.0.0.beta1 to before 11.0.0.beta311.0.0.beta3Patch availableGHSA-g3wg-6mcf-8jj6
  • Eclipse Jetty VendorEclipse Foundation Affected 1.0 to 9.4.32.v20200930; 10.0.0.alpha1 to 10.0.0.beta2; 11.0.0.alpha1 to 11.0.0.beta2 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-webapp (Maven) Vendor— Affected before 9.4.33.v20201020 Fixed in 9.4.33.v20201020 Patch available GHSA-g3wg-6mcf-8jj6
  • org.mortbay.jetty:jetty-webapp (Maven) Vendor— Affected before 9.4.33 Fixed in 9.4.33 Patch available GHSA-g3wg-6mcf-8jj6
  • org.eclipse.jetty:jetty-webapp (Maven) Vendor— Affected 10.0.0.beta1 to before 10.0.0.beta3 Fixed in 10.0.0.beta3 Patch available GHSA-g3wg-6mcf-8jj6
  • org.mortbay.jetty:jetty-webapp (Maven) Vendor— Affected 10.0.0.beta1 to before 10.0.0.beta3 Fixed in 10.0.0.beta3 Patch available GHSA-g3wg-6mcf-8jj6
  • org.eclipse.jetty:jetty-webapp (Maven) Vendor— Affected 11.0.0.beta1 to before 11.0.0.beta3 Fixed in 11.0.0.beta3 Patch available GHSA-g3wg-6mcf-8jj6
  • org.mortbay.jetty:jetty-webapp (Maven) Vendor— Affected 11.0.0.beta1 to before 11.0.0.beta3 Fixed in 11.0.0.beta3 Patch available GHSA-g3wg-6mcf-8jj6

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*1.0 to before 9.3.29; 9.4.0 – 9.4.32VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:*10.0.0 alpha1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:*10.0.0 beta0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:*10.0.0 beta1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*10.0.0 beta2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:alpha1:*:*:*:*:*:*11.0.0 alpha1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:*11.0.0 beta1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*11.0.0 beta2VulnerableEclipse Foundation
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 1.0 to before 9.3.29; 9.4.0 – 9.4.32 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:* Versions 10.0.0 alpha1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:* Versions 10.0.0 beta0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:* Versions 10.0.0 beta1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:* Versions 10.0.0 beta2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:alpha1:*:*:*:*:*:* Versions 11.0.0 alpha1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:* Versions 11.0.0 beta1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:* Versions 11.0.0 beta2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:clustered_data_ontap:*:*7.2VulnerableNetApp
cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*7.2VulnerableNetApp
cpe:2.3:a:netapp:storage_replication_adapter:*:*:*:*:*:clustered_data_ontap:*:*7.2VulnerableNetApp
cpe:2.3:a:vmware:vsphere:-:*:*:*:*:*:*:*not specified by NVDRunning onVMware
cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p2:*:*:*:*:*:*:*3.9m0p2VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*6.2VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*8.2.1 – 8.2.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*11.5.0 – 11.9.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.6.0VulnerableOracle
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*up to 21.5VulnerableOracle
cpe:2.3:a:apache:beam:2.21.0:*:*:*:*:*:*:*2.21.0VulnerableApache
cpe:2.3:a:apache:beam:2.22.0:*:*:*:*:*:*:*2.22.0VulnerableApache
cpe:2.3:a:apache:beam:2.23.0:*:*:*:*:*:*:*2.23.0VulnerableApache
cpe:2.3:a:apache:beam:2.24.0:*:*:*:*:*:*:*2.24.0VulnerableApache
cpe:2.3:a:apache:beam:2.25.0:*:*:*:*:*:*:*2.25.0VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:clustered_data_ontap:*:* Versions 7.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:* Versions 7.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_replication_adapter:*:*:*:*:*:clustered_data_ontap:*:* Versions 7.2 Vulnerable ·NetApp
  • cpe:2.3:a:vmware:vsphere:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VMware
  • cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p2:*:*:*:*:*:*:* Versions 3.9m0p2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.1 – 8.2.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:* Versions 11.5.0 – 11.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* Versions up to 21.5 Vulnerable ·Oracle
  • cpe:2.3:a:apache:beam:2.21.0:*:*:*:*:*:*:* Versions 2.21.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:beam:2.22.0:*:*:*:*:*:*:* Versions 2.22.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:beam:2.23.0:*:*:*:*:*:*:* Versions 2.23.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:beam:2.24.0:*:*:*:*:*:*:* Versions 2.24.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:beam:2.25.0:*:*:*:*:*:*:* Versions 2.25.0 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-g3wg-6mcf-8jj6 org.eclipse.jetty:jetty-webapp (Maven) Fixed in 9.4.33.v20201020 Advisory →
  • Fix · GHSA-g3wg-6mcf-8jj6 org.mortbay.jetty:jetty-webapp (Maven) Fixed in 9.4.33 Advisory →
  • Fix · GHSA-g3wg-6mcf-8jj6 org.eclipse.jetty:jetty-webapp (Maven) Fixed in 10.0.0.beta3 Advisory →
  • Fix · GHSA-g3wg-6mcf-8jj6 org.mortbay.jetty:jetty-webapp (Maven) Fixed in 10.0.0.beta3 Advisory →
  • Fix · GHSA-g3wg-6mcf-8jj6 org.eclipse.jetty:jetty-webapp (Maven) Fixed in 11.0.0.beta3 Advisory →
  • Fix · GHSA-g3wg-6mcf-8jj6 org.mortbay.jetty:jetty-webapp (Maven) Fixed in 11.0.0.beta3 Advisory →

Red Hat 7 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:2431 Released 2021-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.5.41 security update
    • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins-4.5.1623326336-1.el7, jenkins-2.277.3.1623846768-1.el7
  • RHSA-2021:2517 Released 2021-06-30 · Red Hat rating Important
    OpenShift Container Platform 3.11.462 bug fix and security update
    • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1624366838-1.el7, jenkins-2.289.1.1624365627-1.el7
Show 4 more Red Hat advisories
  • RHSA-2021:2499 Released 2021-06-29 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.36 security update
    • Red Hat OpenShift Container Platform 4.6 jenkins-2.277.3.1623853726-1.el8
  • RHSA-2021:0329 Released 2021-02-02 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.4.6 release and security update
    • Red Hat AMQ LTS 7.4.6
  • RHSA-2020:5365 Released 2020-12-08 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8 release and security update
    • Red Hat AMQ
  • RHSA-2020:5168 Released 2020-11-23 · Red Hat rating Moderate
    rh-eclipse security, bug fix and enhancement update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rh-eclipse-1:4.17-6.el7_9, rh-eclipse-ant-1.10.9-1.2.el7, rh-eclipse-ant-antlr-1.10.9-1.2.el7 +47
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse-1:4.17-6.el7_9, rh-eclipse-ant-1.10.9-1.2.el7, rh-eclipse-ant-antlr-1.10.9-1.2.el7 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
7Server-RHMTC-1.4Fixed—
8Base-RHMTC-1.4Fixed—
Red Hat AMQFixed RHSA-2020:5365
Red Hat AMQ LTS 7.4.6Fixed RHSA-2021:0329
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5168
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5168
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:2517
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2021:2431
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:2499
Not affected: 6 products
  • Red Hat Decision Manager 7
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.5
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27216
  2. 2026-10-03 Alias added: GHSA-g3wg-6mcf-8jj6

References

Exploit 2

Patch 4

Advisory 5

Other 267

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences