Local Privilege Escalation in Eclipse Jetty on Unix Systems

CVE-2020-27216

What is CVE-2020-27216?

In certain versions of Eclipse Jetty, a vulnerability exists where the system's temporary directory is shared among all users, creating the potential for local privilege escalation. An attacker can race against legitimate processes to create a subdirectory, ultimately gaining access to unpacked web applications and their associated files like JAR and JSP files. If the attacker successfully executes code from this temporary directory, they could escalate their privileges on the system.

References