PT-2019-15239 · Eclipse · Eclipse Jetty

Jon Are · Publicado 2019-11-25 · Atualizado 2021-06-14 · CVE-2019-17632

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.21.v20190926 through 9.4.23.v20191118

Description The issue concerns the generation of default unhandled Error response content in Eclipse Jetty, where Exception messages in stacktraces included in error output are not properly escaped. This affects the text/html and text/json Content-Type.

Recommendations For Eclipse Jetty versions 9.4.21.v20190926 through 9.4.23.v20191118, consider updating to a version where this issue is fixed, as the current versions do not properly escape Exception messages in error responses. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-17632

GHSA-5H9J-Q6J2-253F

Produtos afetados

Eclipse Jetty

Referências · 14

• https://security-tracker.debian.org/tracker/CVE-2019-17632 · Aviso do Fabricante
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-17632 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-17632 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17632 · Nota
• https://oracle.com/security-alerts/cpuApr2021.html · Nota
• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• https://osv.dev/vulnerability/CVE-2019-17632 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17632 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17632 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17632 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5h9j-q6j2-253f · Aviso do Fabricante