CVE-2019-10241 Security Details

CVE ID

CVE-2019-10241

CWE

CWE-79

CVE Description

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Published

Apr 23, 2019

CVSS Score & Severity

6.1Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

10.411%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/eclipse/jetty/server/ResourceService.sendDirectory(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;Lorg/eclipse/jetty/util/resource/Resource;Ljava/lang/String;)V

JVMVulnerable params: 0, 2

org/eclipse/jetty/server/handler/ResourceHandler.doDirectory(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;Lorg/eclipse/jetty/util/resource/Resource;)V

JVMVulnerable params: 0, 2

org/eclipse/jetty/servlet/DefaultServlet.sendDirectory(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;Lorg/eclipse/jetty/util/resource/Resource;Ljava/lang/String;)V

JVMVulnerable params: 0, 2

org/eclipse/jetty/util/resource/Resource.getListHTML(Ljava/lang/String;Z)Ljava/lang/String;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

bugs.eclipse.orgPROJECT