{
  "@id": "urn:uuid:3cb896c3-4f5b-469f-8f82-ac80db465a9b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:56:00.071407+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:56:00.071407+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 (Jetty symlink webapps deployment vulnerability) is NOT present in target version 11.0.31. The vulnerability allowed symlinked webapps directories to be deployed as static applications, exposing their contents. The upstream fix, using Files.isSameFile() to detect and reject monitored directories during scanning, was already included in the Jetty releases (11.0.10 and 11.0.26) tha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 (Jetty symlink webapps deployment vulnerability) is NOT present in target version 11.0.31. The vulnerability allowed symlinked webapps directories to be deployed as static applications, exposing their contents. The upstream fix, using Files.isSameFile() to detect and reject monitored directories during scanning, was already included in the Jetty releases (11.0.10 and 11.0.26) tha..."
    }
  ]
}