Detections
Analytics

SCA: security update for org.eclipse.jetty:jetty-webapp, org.mortbay.jetty:jetty-webapp (GHSA-g3wg-6mcf-8jj6)

high Tenable Cloud Security Plugin ID 414834

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1
 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on
 that system. A collocated user can observe the process of creating a temporary sub directory in the shared
 temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins
 the race then they will have read and write permission to the subdirectory used to unpack web
 applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of
 this temporary directory, this can lead to a local privilege escalation vulnerability. (CVE-2020-27216)

See Also

https://github.com/advisories/GHSA-g3wg-6mcf-8jj6

Plugin Details

Severity: High

ID: 414834

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-27216

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.3

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/4/2020

Vulnerability Publication Date: 10/23/2020

Reference Information

CVE: CVE-2020-27216