CVE-2019-10247

Eclipse Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older suffer from an information disclosure vulnerability in the DefaultHandler. When no Context matches the requested path, the Jetty server returns a 404 error page that includes an HTML list of all configured contexts, displaying the fully qualified directory base resource location for each context [1][2]. The affected handler is part of the default handler tree in both jetty-distribution and jetty-home distributions.

The vulnerability is exploitable without authentication; simply requesting an invalid path on a running Jetty instance triggers the default 404 page. The attack surface includes any Jetty server exposing these endpoints, requiring only network access to the server's HTTP port. No special privileges or user interaction are needed [1][2].

An attacker who observes the 404 error page can learn the absolute filesystem paths for each deployed web application context. This leaked information aids in mapping the server's directory structure, potentially facilitating further attacks such as path traversal or targeted file access. The disclosure is limited to directory paths and does not directly expose file contents or credentials [2].

The issue was fixed in Jetty versions 9.2.28, 9.3.27, 9.4.17, and later releases. Users should upgrade to these or newer versions. For environments where upgrading is not immediately possible, administrators can consider customizing the 404 error handler to suppress context path details [2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.