| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 9.3.0, < 9.3.26.v20190403≥ 9.4.0, < 9.4.16.v20190411< 9.2.27.v20190403 | 9.3.26.v201904039.4.16.v201904119.2.27.v20190403 |
| activemq | = 5.15.9 | |
| drill | = 1.16.0 | |
| jetty | = 9.2.0= 9.2.1= 9.2.10= 9.2.11= 9.2.12= 9.2.13= 9.2.14= 9.2.15= 9.2.16= 9.2.17= 9.2.18= 9.2.19= 9.2.2= 9.2.20= 9.2.21= 9.2.22= 9.2.23= 9.2.24= 9.2.25= 9.2.26= 9.2.3= 9.2.4= 9.2.5= 9.2.6= 9.2.7= 9.2.8= 9.2.9= 9.3.0= 9.3.1= 9.3.10= 9.3.11= 9.3.12= 9.3.13= 9.3.14= 9.3.15= 9.3.16= 9.3.17= 9.3.18= 9.3.19= 9.3.2= 9.3.20= 9.3.21= 9.3.22= 9.3.23= 9.3.24= 9.3.25= 9.3.3= 9.3.4= 9.3.5= 9.3.6= 9.3.7= 9.3.8= 9.3.9= 9.4.0= 9.4.1= 9.4.10= 9.4.11= 9.4.12= 9.4.13= 9.4.14= 9.4.15= 9.4.2= 9.4.3= 9.4.4= 9.4.5= 9.4.6= 9.4.7= 9.4.8= 9.4.9 | |
| flexcube core banking | = 5.2.0≥ 11.5.0, ≤ 11.7.0 | |
| rest data services | = 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c | |
| retail xstore point of service | = 15.0= 16.0= 17.0= 7.1 |
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free