PT-2019-15239 · Eclipse · Eclipse Jetty

Jon Are · Published 2019-11-25 · Updated 2021-06-14 · CVE-2019-17632

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.21.v20190926 through 9.4.23.v20191118

Description The issue concerns the generation of default unhandled Error response content in Eclipse Jetty, where Exception messages in stacktraces included in error output are not properly escaped. This affects the text/html and text/json Content-Type.

Recommendations For Eclipse Jetty versions 9.4.21.v20190926 through 9.4.23.v20191118, consider updating to a version where this issue is fixed, as the current versions do not properly escape Exception messages in error responses. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17632

GHSA-5H9J-Q6J2-253F

Affected Products

Eclipse Jetty

References · 14

• https://security-tracker.debian.org/tracker/CVE-2019-17632 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17632 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17632 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17632 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17632 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17632 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17632 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h9j-q6j2-253f · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17632 · Note
• https://oracle.com/security-alerts/cpuApr2021.html · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note