CVE-2019-10246: eclipse jetty
Vulnerability summary
CVE-2019-10246 is a medium (CVSS 5.3) vulnerability in eclipse jetty. EPSS estimates a 4.09% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities.
Timeline
- 22-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
4.09%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.09% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-213Exposure of Sensitive Information Due to Incompatible PoliciesThe product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Oracle15 products
- autovue21.0.2
- communications_analytics12.1.1
- communications_element_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
- communications_services_gatekeeper6.0 | 6.1 | 7.0
- communications_session_report_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
Netapp9 products
- elementna
- oncommand_system_manager≥ 3.0, ≤ 3.1.3
- snap_creator_frameworkna
- snapcenterna
- snapmanagerna
Chainguard3 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Eclipse1 product
- jettyEOL9.2.27:20190403 | 9.3.26:20190403 | 9.4.16:20190411
Org.eclipse.jetty1 product
- jetty-server≥ 9.2.0, < 9.2.28.v20190418 | ≥ 9.3.0, < 9.3.27.v20190418 | ≥ 9.4.0, < 9.4.17.v20190418
The eclipse foundation1 product
- eclipse jetty9.2.27 | 9.3.26 | 9.4.16
6 vendors · 30 products
References
15 links- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCThird Party AdvisoryAdvisoryWEB
- bugs.eclipse.org/bugs/show_bug.cgi?id=546576X Refsource CONFIRMIssue TrackingVendor AdvisoryREPORTWEB
