Medium severity · published Apr 22, 2019
CVE-2019-10247
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured…
5.3
CVSS
5.9%
EPSS
No
On KEV
Description
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.9% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Autovue · Oracle
21.0.2 · source: NVD
CA
CE
Communications Element Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CS
CS
Communications Session Report Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CS
Communications Session Route Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
DI
Data Integrator · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
EL
Element · Netapp
All versions, or not specified · source: NVD
FC
Flexcube Core Banking · Oracle
11.5.0 through 11.7.0; 5.2.0 · source: NVD