NetSight
IP …
medium5.3

CVE-2019-10246

Information Exposure vulnerability in Eclipse Jetty

Impact

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.eclipse.jetty:jetty-server>= 9.2.0, <= 9.2.27.v201904039.2.28.v20190418

Affected products

VendorProductAffected versions
EclipseJetty
Versions 9.2.27, 9.3.26, 9.4.16
NetappOncommand System Manager
from 3.0 through 3.1.3
NetappSnap Creator Framework
All versions
NetappSnapcenter
All versions
NetappSnapmanager
All versions
NetappStorage Replication Adapter For Clustered Data Ontap
from 9.6
Version 9.6
NetappStorage Services Connector
All versions
NetappVasa Provider For Clustered Data Ontap
from 9.6
All versions
NetappVirtual Storage Console
from 9.6
Version 9.6
NetappElement
All versions
OracleAutovue
Version 21.0.2
OracleCommunications Analytics
Version 12.1.1

Weakness classification

CWE-213CWE-200

References