CVEvulnerability

CVE-2019-10241

6.1 MEDIUM Published 2019-04-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Affected configurations

• eclipse jetty 9.2.0 • eclipse jetty 9.2.1 • eclipse jetty 9.2.2 • eclipse jetty 9.2.3 • eclipse jetty 9.2.4 • eclipse jetty 9.2.5 • eclipse jetty 9.2.6 • eclipse jetty 9.2.7 • eclipse jetty 9.2.8 • eclipse jetty 9.2.9 • eclipse jetty 9.2.10 • eclipse jetty 9.2.11 • eclipse jetty 9.2.12 • eclipse jetty 9.2.13 • eclipse jetty 9.2.14 • eclipse jetty 9.2.15 • eclipse jetty 9.2.16 • eclipse jetty 9.2.17 • eclipse jetty 9.2.18 • eclipse jetty 9.2.19 • eclipse jetty 9.2.20 • eclipse jetty 9.2.21 • eclipse jetty 9.2.22 • eclipse jetty 9.2.23 • eclipse jetty 9.2.24 • eclipse jetty 9.2.25 • eclipse jetty 9.2.26 • eclipse jetty 9.3.0 • eclipse jetty 9.3.1 • eclipse jetty 9.3.2 • eclipse jetty 9.3.3 • eclipse jetty 9.3.4 • eclipse jetty 9.3.5 • eclipse jetty 9.3.6 • eclipse jetty 9.3.7 • eclipse jetty 9.3.8 • eclipse jetty 9.3.9 • eclipse jetty 9.3.10 • eclipse jetty 9.3.11 • eclipse jetty 9.3.12 • eclipse jetty 9.3.13 • eclipse jetty 9.3.14 • eclipse jetty 9.3.15 • eclipse jetty 9.3.16 • eclipse jetty 9.3.17 • eclipse jetty 9.3.18 • eclipse jetty 9.3.19 • eclipse jetty 9.3.20 • eclipse jetty 9.3.21 • eclipse jetty 9.3.22 • eclipse jetty 9.3.23 • eclipse jetty 9.3.24 • eclipse jetty 9.3.25 • eclipse jetty 9.4.0 • eclipse jetty 9.4.1 • eclipse jetty 9.4.2 • eclipse jetty 9.4.3 • eclipse jetty 9.4.4 • eclipse jetty 9.4.5 • eclipse jetty 9.4.6 … and 23 more

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References