GitHub Advisoryadvisory · Maven

GHSA-7vx9-xjhr-rw6h Cross-site Scripting in Eclipse Jetty

MEDIUM Published 2019-04-23 Modified 2021-04-23 Official page ↗
Aliases
CVE-2019-10241
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-04-23

Affected packages

• Maven org.eclipse.jetty:jetty-server: < 9.2.27.v20190403 → fixed in 9.2.27.v20190403 • Maven org.eclipse.jetty:jetty-server: >= 9.3.0, < 9.3.26.v20190403 → fixed in 9.3.26.v20190403 • Maven org.eclipse.jetty:jetty-server: >= 9.4.0, < 9.4.16.v20190411 → fixed in 9.4.16.v20190411

Description

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Related

Alias · CVE (1)

  • CVE-2019-10241 In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References