CVE-2019-10246
Medium
Description
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Eclipse Jetty
PublishedApr 22, 2019
First seenApr 22, 2019
Weakness typeCWE-213CWE-213
How to fix
Update
- org.eclipse.jetty:jetty-server9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.2.27, 9.3.26, 9.4.16 | — |
| netapp oncommand_system_manager | 3.0 ≤ v ≤ 3.1.3 | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp snapmanager | No range specified | — |
| netapp storage_replication_adapter_for_clustered_data_ontap | 9.6 ≤ v, 9.6 | — |
| netapp storage_services_connector | No range specified | — |
| netapp vasa_provider_for_clustered_data_ontap | 9.6 ≤ v, No range specified | — |
| netapp virtual_storage_console | 9.6 ≤ v, 9.6 | — |
| netapp element | No range specified | — |
| oracle autovue | 21.0.2 | — |
| oracle communications_analytics | 12.1.1 | — |
| oracle communications_element_manager | 8.0.0, 8.1.0, 8.1.1, 8.2.0 | — |
| oracle communications_services_gatekeeper | 6.0, 6.1, 7.0 | — |
| oracle communications_session_report_manager | 8.0.0, 8.1.0, 8.1.1, 8.2.0 | — |
| oracle communications_session_route_manager | 8.0.0, 8.1.0, 8.1.1, 8.2.0 | — |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle endeca_information_discovery_integrator | 3.2.0 | — |
| oracle enterprise_manager_base_platform | 13.2, 13.3 | — |
| oracle flexcube_core_banking | 11.5.0 ≤ v ≤ 11.7.0, 5.2.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle hospitality_guest_access | 4.2.0, 4.2.1 | — |
| oracle rest_data_services | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c | — |
| oracle retail_xstore_point_of_service | 7.1, 15.0, 16.0, 17.0 | — |
| oracle unified_directory | 12.2.1.3.0, 12.2.1.4.0 | — |
| org.eclipse.jetty:jetty-serverMaven | 9.2.0 ≤ v < 9.2.28.v20190418, 9.3.0 ≤ v < 9.3.27.v20190418, 9.4.0 ≤ v < 9.4.17.v20190418 | 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.