Skip to content
Fencer Intel
high 7.0

CVE-2020-27216 json

Local Temp Directory Hijacking Vulnerability

published 6y ago modified last mo. also GHSA-g3wg-6mcf-8jj6 , EUVD-2020-1455

cvss
7.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.4%
EPSS 4.4% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Patch / fix

  • maven org.eclipse.jetty:jetty-webapp 9.4.33.v20201020, 10.0.0.beta3, 11.0.0.beta3
  • maven org.mortbay.jetty:jetty-webapp 9.4.33, 10.0.0.beta3, 11.0.0.beta3
  • eclipse jetty 9.3.29
  • oracle jd_edwards_enterpriseone_tools 9.2.6.0
  • jetty9 Debian 14, Debian 13, Debian 12 9.4.33-1

debian advisories DEBIAN-CVE-2020-27216

  • jenkins openshift 4.5 2.277.3.1623846768-1.el7
  • jenkins-2-plugins openshift 4.5 4.5.1623326336-1.el7
  • jenkins openshift 3.11 2.289.1.1624365627-1.el7
  • jenkins-2-plugins openshift 3.11 3.11.1624366838-1.el7
  • jenkins openshift 4.6 2.277.3.1623853726-1.el8
  • rh-eclipse devtools 2020 1:4.17-6.el7_9
  • rh-eclipse-ant devtools 2020 1.10.9-1.2.el7
  • rh-eclipse-ecj devtools 2020 1:4.17-1.1.el7

red hat advisories RHSA-2021:2431RHSA-2021:2517RHSA-2021:2499RHSA-2020:5168

Is CVE-2020-27216 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-27216 updated cvss 7.0

jetty: local temporary directory hijacking vulnerability

  • Red Hat Enterprise Linux 6 jetty-eclipse Red Hat Enterprise Linux 7 jetty-io, jetty-ant, jetty-jmx, jetty-jsp, jetty-xml, jetty-http, +30 more Red Hat Enterprise Linux 8 jetty-io, jetty-http, jetty-util, jetty-server, jetty-servlet, jetty-security, +1 more Red Hat JBoss A-MQ 6 jetty Red Hat JBoss Fuse 6 jetty Red Hat JBoss Fuse Service Works 6 jetty
    +1 more products
    Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop
    affected: workaround, no fix planned “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.”
  • Red Hat AMQ
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2020:5365
  • Red Hat AMQ LTS 7.4.6
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2021:0329
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rh-eclipse 4.17-6.el7_9, rh-eclipse-ecj 4.17-1.1.el7, rh-eclipse-sac 1.3-34.1.el7, rh-eclipse-jna 5.4.0-7.1.el7, rh-eclipse-ant 1.10.9-1.2.el7, rh-eclipse-batik 1.13-1.1.el7, +227 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse 4.17-6.el7_9, rh-eclipse-ecj 4.17-1.1.el7, rh-eclipse-sac 1.3-34.1.el7, rh-eclipse-jna 5.4.0-7.1.el7, rh-eclipse-ant 1.10.9-1.2.el7, rh-eclipse-batik 1.13-1.1.el7, +227 more
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2020:5168
  • Red Hat Fuse 7.9
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2021:3140
  • Red Hat Migration Toolkit 1.4 rhmtc/openshift-migration-ui-rhel8 v1.4.6-4, rhmtc/openshift-velero-plugin-rhel8 v1.4.6-4, rhmtc/openshift-migration-velero-rhel8 v1.4.6-5, rhmtc/openshift-migration-registry-rhel8 v1.4.6-4, rhmtc/openshift-migration-operator-bundle v1.4.6-5, rhmtc/openshift-migration-controller-rhel8 v1.4.6-4, +7 more
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHBA-2021:2854
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.289.1.1624365627-1.el7
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2021:2517
  • Red Hat OpenShift Container Platform 4.5 jenkins 2.277.3.1623846768-1.el7
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2021:2431
show 2 more
  • Red Hat OpenShift Container Platform 4.6 jenkins 2.277.3.1623853726-1.el8
    fixed: vendor fix “Jetty users should create temp folders outside the normal /tmp structure, and ensure that their permissions are set so as not to be accessible by an attacker.” RHSA-2021:2499
  • Red Hat Decision Manager 7 jetty Red Hat OpenShift Container Platform 3.11 python-requests 2.19.1-5.el7, python2-requests 2.19.1-5.el7, prometheus 3.11.462-1.git.99aae51.el7, jenkins-2-plugins 3.11.1624366838-1.el7, openshift-kuryr 3.11.462-1.git.c33a657.el7, atomic-openshift 3.11.462-1.git.0.e7d0362.el7, +37 more Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins 4.5.1623326336-1.el7, openshift 4.5.0-202106011407.p0.git.d8ef5ad.el7, openshift 4.5.0-202106011407.p0.git.d8ef5ad.el8, openshift-kuryr 4.5.0-202106011407.p0.git.75cc301.el8, openshift-ansible 4.5.0-202106011407.p0.git.83db419.el7, openshift-clients 4.5.0-202106011407.p0.git.297a4ac.el7, +12 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.2-6.rhaos4.6.git686e6d9.el7, cri-o 1.19.2-6.rhaos4.6.git686e6d9.el8, openshift-kuryr 4.6.0-202106181055.p0.git.7feb5bd.el8, openshift-clients 4.6.0-202106160917.p0.git.99556b6.el7, openshift-clients 4.6.0-202106160917.p0.git.99556b6.el8, openshift-kuryr-cni 4.6.0-202106181055.p0.git.7feb5bd.el8, +5 more Red Hat Process Automation 7 jetty Red Hat Single Sign-On 7 jetty
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.35% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • bugs.eclipse.org https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-webapp
<9.4.33.v20201020
>=10.0.0.beta1, <10.0.0.beta3
>=11.0.0.beta1, <11.0.0.beta3
9.4.33.v20201020
10.0.0.beta3
11.0.0.beta3
maven org.mortbay.jetty:jetty-webapp
<9.4.33
>=10.0.0.beta1, <10.0.0.beta3
>=11.0.0.beta1, <11.0.0.beta3
9.4.33
10.0.0.beta3
11.0.0.beta3

Affected products

  • The Eclipse Foundation Eclipse Jetty

Classification

Weakness
  • CWE-378 Creation of Temporary File With Insecure Permissions
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions
  • CWE-552 Files or Directories Accessible to External Parties

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.