CVE-2020-27216

Eclipse Jetty creates temporary directories in a shared system folder that any user can access. An attacker on the same computer can race to take control of these folders before Jetty finishes setting them up, potentially gaining access to sensitive application files and executing malicious code with elevated privileges.

CWE-378/379 race condition in temporary directory creation on Unix systems. An unprivileged local user can exploit a time-of-check-time-of-use (TOCTOU) vulnerability during the unpacking of web applications to the shared /tmp directory, gaining read/write access to WEB-INF/lib and JSP files. Successful exploitation enables local privilege escalation if code execution occurs from the compromised temporary location.