Information Exposure vulnerability in Eclipse Jetty

MEDIUM 5.3CVE-2019-10246 · GHSA-r28m-g6j9-r2h5 · Published 22/04/2019 · updated 17/06/2026

In short

CVE-2019-10246 is a MEDIUM (CVSS 5.3) vulnerability affecting org.eclipse.jetty:jetty-server, jetty (eclipse), oncommand system manager (netapp).
Chance of exploitation in the next 30 days (EPSS): 4.1%, higher than 90.7% of all vulnerabilities.
Fix: update to 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418 or later.

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-server Maven	`≥ 9.2.0, < 9.2.28.v20190418≥ 9.3.0, < 9.3.27.v20190418≥ 9.4.0, < 9.4.17.v20190418`	`9.2.28.v201904189.3.27.v201904189.4.17.v20190418`
jetty eclipse	`= 9.2.27= 9.3.26= 9.4.16`	No fix yet
oncommand system manager netapp	`≥ 3.0, ≤ 3.1.3`	No fix yet
storage replication adapter for clustered data ontap netapp	`= 9.6≥ 9.6`	No fix yet
vasa provider for clustered data ontap netapp	`≥ 9.6`	No fix yet
virtual storage console netapp	`= 9.6≥ 9.6`	No fix yet
autovue oracle	`= 21.0.2`	No fix yet
communications analytics oracle	`= 12.1.1`	No fix yet
communications element manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
communications services gatekeeper oracle	`= 6.0= 6.1= 7.0`	No fix yet
communications session report manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
communications session route manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
data integrator oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
endeca information discovery integrator oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 13.2= 13.3`	No fix yet
flexcube core banking oracle	`= 5.2.0≥ 11.5.0, ≤ 11.7.0`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hospitality guest access oracle	`= 4.2.0= 4.2.1`	No fix yet
rest data services oracle	`= 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c`	No fix yet
retail xstore point of service oracle	`= 15.0= 16.0= 17.0= 7.1`	No fix yet
unified directory oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

NVD description

References

More vulnerabilities in org.eclipse.jetty:jetty-server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free