Medium severity · published Jun 27, 2018
CVE-2018-12536
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and…
5.3
CVSS
4.4%
EPSS
No
On KEV
Description
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jetty · Eclipse
9.0.0 through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11 · source: NVD
RX
Retail Xstore Point OF Service · Oracle
7.1; 15.0; 16.0.0; 17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12536
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12536
Third Party Advisory
http://www.securitytracker.com/id/1041194
Vendor Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670
lists.apache.org
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
lists.debian.org
https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20181014-0001/
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
More from Jetty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…
9.8
CVE-2017-7657
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…
9.8
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other…
9.4
CVE-2019-17638
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error