CVE-2021-28163: Apache Ignite

Low severity, CVSS 2.7. EPSS: 4.2% chance of exploitation in the next 30 days.

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Affected products

Apache Ignite: before 2.1.1 (fixed in 2.1.1)
Apache Solr: version 8.8.1 only
Eclipse Jetty: from 9.4.32, before 9.4.39 (fixed in 9.4.39); version 10.0.0 only; version 10.0.1 only; version 11.0.0 only; version 11.0.1 only
Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
Netapp Cloud Manager: affected versions not specified
Netapp E-Series Performance Analyzer: affected versions not specified
Netapp E-Series Santricity OS Controller: from 11.0.0, up to and including 11.70.1
Netapp E-Series Santricity Web Services: affected versions not specified
Netapp Element Plug-In For vCenter Server: affected versions not specified
Netapp Santricity Cloud Connector: affected versions not specified
Netapp Snapcenter: affected versions not specified
Netapp Snapcenter Plug-In: affected versions not specified
Netapp Storage Replication Adapter For Clustered Data Ontap: from 9.6
Netapp Vasa Provider For Clustered Data Ontap: from 9.6
Netapp Virtual Storage Console: from 9.6
Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
Oracle Banking Apis: version 20.1 only; version 21.1 only
Oracle Banking Digital Experience: version 20.1 only; version 21.1 only
Oracle Communications Element Manager: version 8.2.2 only
Oracle Communications Services Gatekeeper: version 7.0 only
Oracle Communications Session Report Manager: from 8.0.0, up to and including 8.2.4.0
Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.4.0
Oracle Siebel Core - Automation: up to and including 21.9

Published 2021-04-01. Last modified 2026-06-17.