CVE-2019-10246
The Eclipse Foundation Eclipse Jetty
MEDIUM 5.3
At a glance
- Source
- NVD
- EPSS
- EPSS 4.09 % · percentile 91 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- eclipse
- NVD status
- Modified
Description
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Weaknesses (CWE)
- CWE-213 — Exposure of Sensitive Information Due to Incompatible Policies
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576
- https://security.netapp.com/advisory/ntap-20190509-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-r28m-g6j9-r2h5 — Information Exposure vulnerability in Eclipse Jetty
European references
- ENISA EUVD · EUVD-2019-0430
- GCVE · GCVE-0-2019-10246
Affected configurations (NVD CPE)
cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*≥ 3.0 ≤ 3.1.3cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:*cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*≥ 9.6cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:*cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*≥ 9.6cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*≥ 9.6cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:*cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:*cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*≥ 11.5.0 ≤ 11.7.0cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*- +14 more
Affected products
| Product | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Jetty | affected 9.2.27 ; affected 9.3.26 ; affected 9.4.16 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |