Medium severity · published Apr 22, 2019
CVE-2019-10246
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a…
5.3
CVSS
4.1%
EPSS
No
On KEV
Description
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Autovue · Oracle
21.0.2 · source: NVD
CA
Communications Analytics · Oracle
12.1.1 · source: NVD
CE
Communications Element Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CS
Communications Services Gatekeeper · Oracle
6.0; 6.1; 7.0 · source: NVD
CS
Communications Session Report Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CS
Communications Session Route Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
DI
Data Integrator · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
EL
Element · Netapp
All versions, or not specified · source: NVD
EI
Endeca Information Discovery Integrator · Oracle
3.2.0 · source: NVD
EM
Enterprise Manager Base Platform · Oracle
13.2; 13.3 · source: NVD
FC
Flexcube Core Banking · Oracle
11.5.0 through 11.7.0; 5.2.0 · source: NVD
FP
Flexcube Private Banking · Oracle
12.0.0; 12.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10246
Issue Tracking
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576
lists.apache.org
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190509-0003/
www.oracle.com
https://www.oracle.com/security-alerts/cpuApr2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
More from Jetty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…
9.8
CVE-2017-7657
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…
9.8
CVE-2016-4800
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other…
9.4
CVE-2019-17638
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error