{
  "@id": "urn:uuid:78390497-2047-462d-9a58-b6ac12d5b6f6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:53:00.130920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T17:53:00.130920+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in target Jetty 9.4.61. The vulnerability allowed symlinked ${jetty.base}/webapps directories to be deployed as static web applications, exposing directory contents. The fix (commit 37fffb17226) was already present in the upstream release when TuxCare onboarded version 9.4.58.1. The target contains the complete defense: WebAppProvider.Filter.accept() uses resource....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in target Jetty 9.4.61. The vulnerability allowed symlinked ${jetty.base}/webapps directories to be deployed as static web applications, exposing directory contents. The fix (commit 37fffb17226) was already present in the upstream release when TuxCare onboarded version 9.4.58.1. The target contains the complete defense: WebAppProvider.Filter.accept() uses resource...."
    }
  ]
}