GitHub Advisoryadvisory · Maven

GHSA-r28m-g6j9-r2h5 Information Exposure vulnerability in Eclipse Jetty

MEDIUM Published 2019-04-23 Modified 2021-04-23 Official page ↗
Aliases
CVE-2019-10246
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-213
Reviewed
2019-04-23

Affected packages

• Maven org.eclipse.jetty:jetty-server: >= 9.2.0, < 9.2.28.v20190418 → fixed in 9.2.28.v20190418 • Maven org.eclipse.jetty:jetty-server: >= 9.3.0, < 9.3.27.v20190418 → fixed in 9.3.27.v20190418 • Maven org.eclipse.jetty:jetty-server: >= 9.4.0, < 9.4.17.v20190418 → fixed in 9.4.17.v20190418

Description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Related

Alias · CVE (1)

  • CVE-2019-10246 In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-213 Exposure of Sensitive Information Due to Incompatible Policies weakness

References