VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Apr 22, 2019· Updated Jun 17, 2026

CVE-2019-10246

CVE-2019-10246

Description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-serverMaven
>= 9.2.0, < 9.2.28.v201904189.2.28.v20190418
org.eclipse.jetty:jetty-serverMaven
>= 9.3.0, < 9.3.27.v201904189.3.27.v20190418
org.eclipse.jetty:jetty-serverMaven
>= 9.4.0, < 9.4.17.v201904189.4.17.v20190418

Affected products

56
  • Eclipse/Jetty4 versions
    cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*
    • cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*
    • cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*
    • (no CPE)range: 9.2.27
  • NetApp/Oncommand System Manager
    cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
    Range: >=3.0,<=3.1.3
  • NetApp/Snap Creator Framework
    cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
  • NetApp/Snapcenter
    cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
  • NetApp/Snapmanager2 versions
    cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*+ 1 more
    • cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*
    • cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:*
  • NetApp/Storage Replication Adapter For Clustered Data Ontap2 versions
    cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*+ 1 more
    • cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*range: >=9.6
    • cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:*
  • NetApp/Storage Services Connector
    cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:*
  • NetApp/Vasa Provider For Clustered Data Ontap2 versions
    cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*range: >=9.6
    • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:-:*:*:*:*:*:*:*
  • NetApp/Virtual Storage Console2 versions
    cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*+ 1 more
    • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*range: >=9.6
    • cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:*
  • Oracle Corporation/Autovue
    cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Analytics
    cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Element Manager4 versions
    cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Services Gatekeeper3 versions
    cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Session Report Manager4 versions
    cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Session Route Manager4 versions
    cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*
  • Oracle Corporation/Data Integrator2 versions
    cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
  • Oracle Corporation/Endeca Information Discovery Integrator
    cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
  • Oracle Corporation/Enterprise Manager Base Platform2 versions
    cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*
  • Oracle Corporation/Flexcube Core Banking2 versions
    cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*range: >=11.5.0,<=11.7.0
    • cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*
  • Oracle Corporation/Flexcube Private Banking2 versions
    cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
  • Oracle Corporation/Hospitality Guest Access2 versions
    cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
  • Oracle Corporation/REST Data Services4 versions
    cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*+ 3 more
    • cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*
    • cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*
    • cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*
    • cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*
  • Oracle Corporation/Retail Xstore Point Of Service4 versions
    cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
  • Oracle Corporation/Unified Directory2 versions
    cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*
  • NetApp/Element
    cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:*
  • ghsa-coords
    pkg:maven/org.eclipse.jetty/jetty-server
    Range: >= 9.2.0, < 9.2.28.v20190418

Patches

Vulnerability mechanics

References

16

News mentions

0

No linked articles in our index yet.