In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Project Subscriptions

Vendors Products
Debian Linux Subscribe
Eclipse Subscribe
Element Subscribe
Oncommand System Manager Subscribe
Snap Creator Framework Subscribe
Snapcenter Subscribe
Snapmanager Subscribe
Storage Replication Adapter For Clustered Data Ontap Subscribe
Storage Services Connector Subscribe
Vasa Provider For Clustered Data Ontap Subscribe
Virtual Storage Console Subscribe
Autovue Subscribe
Communications Analytics Subscribe
Communications Element Manager Subscribe
Communications Services Gatekeeper Subscribe
Communications Session Report Manager Subscribe
Communications Session Route Manager Subscribe
Data Integrator Subscribe
Endeca Information Discovery Integrator Subscribe
Enterprise Manager Base Platform Subscribe
Flexcube Core Banking Subscribe
Flexcube Private Banking Subscribe
Fmw Platform Subscribe
Hospitality Guest Access Subscribe
Retail Xstore Point Of Service Subscribe
Unified Directory Subscribe
Amq Broker Subscribe
Jboss Fuse Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2661-1 jetty9 security update
Debian DSA Debian DSA DSA-4949-1 jetty9 security update
EUVD EUVD EUVD-2019-0440 In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
Github GHSA Github GHSA GHSA-xc67-hjx6-cgg6 Installation information leak in Eclipse Jetty
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577 cve-icon cve-icon
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-10247 cve-icon
https://security.netapp.com/advisory/ntap-20190509-0003/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-10247 cve-icon
https://www.debian.org/security/2021/dsa-4949 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2024-08-04T22:17:19.834Z

Reserved: 2019-03-27T00:00:00.000Z

Link: CVE-2019-10247

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-04-22T20:29:00.367

Modified: 2024-11-21T04:18:44.293

Link: CVE-2019-10247

cve-icon Redhat

Severity : Low

Publid Date: 2019-04-18T00:00:00Z

Links: CVE-2019-10247 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses