CVE-2019-10241
Medium
Description
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Eclipse Jetty
PublishedApr 22, 2019
First seenApr 22, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- org.eclipse.jetty:jetty-server9.2.27.v20190403, 9.3.26.v20190403, 9.4.16.v20190411 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10, 9.2.11, 9.2.12, 9.2.13, 9.2.14, 9.2.15, 9.2.16, 9.2.17, 9.2.18, 9.2.19, 9.2.20, 9.2.21, 9.2.22, 9.2.23, 9.2.24, 9.2.25, 9.2.26, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7, 9.3.8, 9.3.9, 9.3.10, 9.3.11, 9.3.12, 9.3.13, 9.3.14, 9.3.15, 9.3.16, 9.3.17, 9.3.18, 9.3.19, 9.3.20, 9.3.21, 9.3.22, 9.3.23, 9.3.24, 9.3.25, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.4.8, 9.4.9, 9.4.10, 9.4.11, 9.4.12, 9.4.13, 9.4.14, 9.4.15 | — |
| debian debian_linux | 9.0, 10.0 | — |
| apache activemq | 5.15.9 | — |
| apache drill | 1.16.0 | — |
| oracle flexcube_core_banking | 11.5.0 ≤ v ≤ 11.7.0, 5.2.0 | — |
| oracle rest_data_services | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c | — |
| oracle retail_xstore_point_of_service | 7.1, 15.0, 16.0, 17.0 | — |
| org.eclipse.jetty:jetty-serverMaven | v < 9.2.27.v20190403, 9.3.0 ≤ v < 9.3.26.v20190403, 9.4.0 ≤ v < 9.4.16.v20190411 | 9.2.27.v20190403, 9.3.26.v20190403, 9.4.16.v20190411 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.