Information Exposure vulnerability in Eclipse Jetty

MITTEL 5.3CVE-2019-10246 · GHSA-r28m-g6j9-r2h5 · Published 22/04/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-10246 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in org.eclipse.jetty:jetty-server, jetty (eclipse), oncommand system manager (netapp).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 4.1%, höher als bei 90.7% aller Schwachstellen.
Abhilfe: auf 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-server Maven	`≥ 9.2.0, < 9.2.28.v20190418≥ 9.3.0, < 9.3.27.v20190418≥ 9.4.0, < 9.4.17.v20190418`	`9.2.28.v201904189.3.27.v201904189.4.17.v20190418`
jetty eclipse	`= 9.2.27= 9.3.26= 9.4.16`	No fix yet
oncommand system manager netapp	`≥ 3.0, ≤ 3.1.3`	No fix yet
storage replication adapter for clustered data ontap netapp	`= 9.6≥ 9.6`	No fix yet
vasa provider for clustered data ontap netapp	`≥ 9.6`	No fix yet
virtual storage console netapp	`= 9.6≥ 9.6`	No fix yet
autovue oracle	`= 21.0.2`	No fix yet
communications analytics oracle	`= 12.1.1`	No fix yet
communications element manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
communications services gatekeeper oracle	`= 6.0= 6.1= 7.0`	No fix yet
communications session report manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
communications session route manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
data integrator oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
endeca information discovery integrator oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 13.2= 13.3`	No fix yet
flexcube core banking oracle	`= 5.2.0≥ 11.5.0, ≤ 11.7.0`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hospitality guest access oracle	`= 4.2.0= 4.2.1`	No fix yet
rest data services oracle	`= 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c`	No fix yet
retail xstore point of service oracle	`= 15.0= 16.0= 17.0= 7.1`	No fix yet
unified directory oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

NVD description

References

Weitere Schwachstellen in org.eclipse.jetty:jetty-server

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free