Skip to main content
No exploitation reportedFix available

CVE-2020-27216

No exploitation reported by the sources we read.

  • Published2020-10-23
  • WeaknessCWE-378 · CWE-379

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Timeline

dates in UTC
  1. 2020-10-2313:15CVE publishedNVD

Versions per branch

NVD · OSV
Apache beam
BranchAffectedFixed in
2.21= 2.21.0no fix published
2.22= 2.22.0no fix published
2.23= 2.23.0no fix published
2.24= 2.24.0no fix published
2.25= 2.25.0no fix published
Eclipse jetty
BranchAffectedFixed in
9.3≥ 1.0, < 9.3.299.3.29
9.4≥ 9.4.0, ≤ 9.4.32no fix published
10.0= 10.0.0no fix published
11.0= 11.0.0no fix published
jetty-webapp
BranchAffectedFixed in
11.0≥ 11.0.0.beta1, < 11.0.0.beta311.0.0.beta3
10.0≥ 10.0.0.beta1, < 10.0.0.beta310.0.0.beta3
9.4< 9.4.33.v202010209.4.33.v20201020

17 more products in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • apache-hiveCleanStartall versions · fixed in 3.1.3-r3
  • hadoop-fips-3.3.6Chainguardall versions · fixed in 3.3.6-r15
  • hadoop-fips-3.3.6Chainguardall versions · fixed in 3.3.6-r21
  • hadoop-fips-3.5Chainguardall versions · no fixed version listedand 1 other package
  • jenkinsRed Hat:openshift:4.6::el8all versions · fixed in 0:2.277.3.1623853726-1.el8
  • jenkinsRed Hat:openshift:4.5::el7all versions · fixed in 0:2.277.3.1623846768-1.el7
  • jenkinsRed Hat:openshift:3.11::el7all versions · fixed in 0:2.289.1.1624365627-1.el7
  • jenkins-2-pluginsRed Hat:openshift:4.5::el7all versions · fixed in 0:4.5.1623326336-1.el7

81 more package ranges on OSV.dev

Vendor advisories

  • CVE-2020-27216 Red Hat Product Security616 products fixed · 50 known affected

    jetty: local temporary directory hijacking vulnerability

    jetty-eclipse as a component of Red Hat Enterprise Linux 6 · jetty-eclipse.src as a component of Red Hat Enterprise Linux 6 · jetty-annotations as a component of Red Hat Enterprise Linux 7 · +47 more

  • RHSA-2021:3140 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Fuse 7.9.0 release and security update

  • RHBA-2021:2854 Red Hat Product Security13 products fixed

    Red Hat Bug Fix Advisory: Migration Toolkit for Containers (MTC) 1.4.6 release advisory

  • RHSA-2021:2431 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: OpenShift Container Platform 4.5.41 security update

  • RHSA-2021:2517 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: OpenShift Container Platform 3.11.462 bug fix and security update

  • RHSA-2021:2499 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: OpenShift Container Platform 4.6.36 security update

3 more advisories

Full record on NVD

Fix

  1. Vendor fix Red Hat Product Security RHSA-2021:3140 · 1 productBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.9.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat…
  2. Vendor fix Red Hat Product Security RHBA-2021:2854 · 13 productsBefore applying this update, ensure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 For details on how to install and use MTC, refer to: https://docs.openshift.com/container-pla…
  3. Vendor fix Red Hat Product Security RHSA-2021:2431 · 2 productsFor OpenShift Container Platform 4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-r…
  4. Vendor fix Red Hat Product Security RHSA-2021:2517 · 2 productsSee the following documentation, which will be updated shortly for release 3.11.462, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update …
  5. Vendor fix Red Hat Product Security RHSA-2021:2499 · 2 productsFor OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-r…
  6. Vendor fix Red Hat Product Security RHSA-2021:0329 · 1 productBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update).

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

  • NVDCVSS 3.17read 2026-10-23
  • NVDCVSS 2.04.4read 2026-10-23
  • CNAweakness (CWE)CWE-378, CWE-379known since 2026-10-23
  • FIRST EPSSEPSS score4.4 %2026-11-08
  • OSVaffected packages—
  • GitHub AdvisoriesadvisoryHIGH2020-11-04

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
2020-10-23
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-g3wg-6mcf-8jj6

Frequently asked questions

What is CVE-2020-27216?

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Is CVE-2020-27216 actively exploited?

Active exploitation of CVE-2020-27216 has not been confirmed. Its EPSS score was 4.4% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2020-27216?

CVE-2020-27216 has a CVSS v3 base score of 7 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Running jetty? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record