PT-2019-3889 · Eclipse · Eclipse Jetty

Published 2019-04-18 · Updated 2021-06-14 · CVE-2019-10246

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16

Description The issue is related to the exposure of the fully qualified Base Resource directory name on Windows to a remote client when the server is configured to show a listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Recommendations For Eclipse Jetty version 9.2.27, consider disabling the directory listing feature to prevent exposure of sensitive information. For Eclipse Jetty version 9.3.26, restrict access to the base resource directories to minimize the risk of exploitation. For Eclipse Jetty version 9.4.16, avoid configuring the server to show directory contents until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-213

Related Identifiers

BDU:2019-04282

CVE-2019-10246

GHSA-R28M-G6J9-R2H5

Affected Products

Eclipse Jetty

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2019-10246 · Security Note
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10246 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04282 · Security Note
• https://osv.dev/vulnerability/GHSA-r28m-g6j9-r2h5 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2020.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10246 · Note
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Note
• https://security.netapp.com/advisory/ntap-20190509-0003 · Note
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E · Note
• https://t.me/cvenotify/11428 · Telegram Post
• https://oracle.com/security-alerts/cpuApr2021.html · Note
• https://oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note