Information Exposure vulnerability in Eclipse Jetty

MÉDIO 5.3CVE-2019-10246 · GHSA-r28m-g6j9-r2h5 · Published 22/04/2019 · updated 17/06/2026

Em resumo

CVE-2019-10246 é uma vulnerabilidade MÉDIO (CVSS 5.3) que afeta org.eclipse.jetty:jetty-server, jetty (eclipse), oncommand system manager (netapp).
Chance de exploração nos próximos 30 dias (EPSS): 4.1%, maior que 90.7% das vulnerabilidades.
Correção: atualize para 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418 ou posterior.

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-server Maven	`≥ 9.2.0, < 9.2.28.v20190418≥ 9.3.0, < 9.3.27.v20190418≥ 9.4.0, < 9.4.17.v20190418`	`9.2.28.v201904189.3.27.v201904189.4.17.v20190418`
jetty eclipse	`= 9.2.27= 9.3.26= 9.4.16`	No fix yet
oncommand system manager netapp	`≥ 3.0, ≤ 3.1.3`	No fix yet
storage replication adapter for clustered data ontap netapp	`= 9.6≥ 9.6`	No fix yet
vasa provider for clustered data ontap netapp	`≥ 9.6`	No fix yet
virtual storage console netapp	`= 9.6≥ 9.6`	No fix yet
autovue oracle	`= 21.0.2`	No fix yet
communications analytics oracle	`= 12.1.1`	No fix yet
communications element manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
communications services gatekeeper oracle	`= 6.0= 6.1= 7.0`	No fix yet
communications session report manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
communications session route manager oracle	`= 8.0.0= 8.1.0= 8.1.1= 8.2.0`	No fix yet
data integrator oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
endeca information discovery integrator oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 13.2= 13.3`	No fix yet
flexcube core banking oracle	`= 5.2.0≥ 11.5.0, ≤ 11.7.0`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hospitality guest access oracle	`= 4.2.0= 4.2.1`	No fix yet
rest data services oracle	`= 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c`	No fix yet
retail xstore point of service oracle	`= 15.0= 16.0= 17.0= 7.1`	No fix yet
unified directory oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

NVD description

References

Mais vulnerabilidades de org.eclipse.jetty:jetty-server

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free