PT-2018-3159 · Eclipse+1 · Eclipse Jetty Server+1

Published 2018-06-07 · Updated 2021-09-23 · CVE-2018-12536

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.x

Description The issue is related to the DefaultServlet's handling of intentionally bad queries that do not match a dynamic url-pattern. When such a query is handled by the DefaultServlet's static file serving, it can trigger a java.nio.file.InvalidPathException, which includes the full path to the base resource directory. If this exception is then handled by the default Error Handler, the exception message is included in the error response, revealing the full server path to the requesting system.

Recommendations For Eclipse Jetty Server versions 9.x, consider disabling the default Error Handling mechanism to prevent the disclosure of sensitive server path information. As a temporary workaround, restrict access to the DefaultServlet's static file serving functionality until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

ALT-PU-2019-2113

ALT-PU-2021-2857

BDU:2019-04281

CVE-2018-12536

DLA-2661-1

GHSA-9RGV-H7X4-QW8G

Affected Products

Alt Linux

Eclipse Jetty Server

References · 48

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241 · Security Note
• https://osv.dev/vulnerability/DLA-2661-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-2857 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04264 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27216 · Security Note
• https://ubuntu.com/security/CVE-2018-12536 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04177 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-12536 · Security Note
• https://bdu.fstec.ru/vul/2019-04281 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9735 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch
• https://bdu.fstec.ru/vul/2022-02668 · Security Note
• https://security-tracker.debian.org/tracker/DLA-2661-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658 · Security Note