What is the CVSS score of CVE-2020-27216?

CVE-2020-27216 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.3%.

Is there a public PoC exploit available for CVE-2020-27216?

Yes, a public proof-of-concept exploit is available for CVE-2020-27216. Prioritise patching immediately. EPSS: 4.3%.

Is there a patch available for CVE-2020-27216?

Yes, a patch is available for CVE-2020-27216. Update the affected software to the latest version immediately.

Jetty CVE-2020-27216

HIGH

Creation of Temporary File With Insecure Permissions (CWE-378)

2020-10-23 emo@eclipse.org

Privilege Escalation Jetty Snap Creator Framework Snapcenter Vasa Provider Virtual Storage Console Storage Replication Adapter Communications Application Session Controller Communications Converged Application Server Service Controller Communications Element Manager Communications Offline Mediation Controller Communications Pricing Design Center Communications Services Gatekeeper Flexcube Core Banking Flexcube Private Banking Jd Edwards Enterpriseone Tools Siebel Core Automation Beam Debian Linux

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 23, 2020 - 13:15 nvd

HIGH 7.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

21 maven packages depend on org.eclipse.jetty:jetty-webapp (13 direct, 8 indirect)

Ecosystem-wide dependent count for version 10.0.0.beta1.

DescriptionNVD

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-378. In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. Affected products include: Eclipse Jetty, Netapp Snap Creator Framework, Netapp Snapcenter, Netapp Vasa Provider, Netapp Virtual Storage Console.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.