CVE-2019-10246
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
En Eclipse Jetty versión 9.2.27, versión 9.3.26 y versión 9.4.16 , el servidor que es ejecutado en Windows es vulnerable a la exposición del nombre del directorio Base Resource totalmente calificado en Windows a un cliente remoto cuando está configurado para mostrar un contenido de listado de directorios (Listing of directory). Esta información revelada está restringida solo al contenido en los directorios de recursos base configurados
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-03-27 CVE Reserved
- 2019-04-22 CVE Published
- 2024-08-04 CVE Updated
- 2024-09-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E | Mailing List | |
| https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E | Mailing List | |
| https://security.netapp.com/advisory/ntap-20190509-0003 | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpuApr2021.html | X_refsource_misc |
|
| https://www.oracle.com/security-alerts/cpuapr2020.html | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpujan2020.html | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpujan2021.html | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpujul2020.html | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpuoct2020.html | Third Party Advisory |
|
| https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 9.2.27 Search vendor "Eclipse" for product "Jetty" and version "9.2.27" | 20190403 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 9.3.26 Search vendor "Eclipse" for product "Jetty" and version "9.3.26" | 20190403 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Eclipse Search vendor "Eclipse" | Jetty Search vendor "Eclipse" for product "Jetty" | 9.4.16 Search vendor "Eclipse" for product "Jetty" and version "9.4.16" | 20190411 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Netapp Search vendor "Netapp" | Oncommand System Manager Search vendor "Netapp" for product "Oncommand System Manager" | >= 3.0 <= 3.1.3 Search vendor "Netapp" for product "Oncommand System Manager" and version " >= 3.0 <= 3.1.3" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snap Creator Framework Search vendor "Netapp" for product "Snap Creator Framework" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snapcenter Search vendor "Netapp" for product "Snapcenter" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snapmanager Search vendor "Netapp" for product "Snapmanager" | - | oracle |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snapmanager Search vendor "Netapp" for product "Snapmanager" | - | sap |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Storage Replication Adapter For Clustered Data Ontap Search vendor "Netapp" for product "Storage Replication Adapter For Clustered Data Ontap" | >= 9.6 Search vendor "Netapp" for product "Storage Replication Adapter For Clustered Data Ontap" and version " >= 9.6" | vmware_vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Storage Replication Adapter For Clustered Data Ontap Search vendor "Netapp" for product "Storage Replication Adapter For Clustered Data Ontap" | 9.6 Search vendor "Netapp" for product "Storage Replication Adapter For Clustered Data Ontap" and version "9.6" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Storage Services Connector Search vendor "Netapp" for product "Storage Services Connector" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Vasa Provider For Clustered Data Ontap Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap" | >= 9.6 Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap" and version " >= 9.6" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Vasa Provider For Clustered Data Ontap Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Virtual Storage Console Search vendor "Netapp" for product "Virtual Storage Console" | >= 9.6 Search vendor "Netapp" for product "Virtual Storage Console" and version " >= 9.6" | vmware_vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Virtual Storage Console Search vendor "Netapp" for product "Virtual Storage Console" | 9.6 Search vendor "Netapp" for product "Virtual Storage Console" and version "9.6" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Element Search vendor "Netapp" for product "Element" | - | vcenter_server |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Autovue Search vendor "Oracle" for product "Autovue" | 21.0.2 Search vendor "Oracle" for product "Autovue" and version "21.0.2" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Analytics Search vendor "Oracle" for product "Communications Analytics" | 12.1.1 Search vendor "Oracle" for product "Communications Analytics" and version "12.1.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager" | 8.0.0 Search vendor "Oracle" for product "Communications Element Manager" and version "8.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager" | 8.1.0 Search vendor "Oracle" for product "Communications Element Manager" and version "8.1.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager" | 8.1.1 Search vendor "Oracle" for product "Communications Element Manager" and version "8.1.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager" | 8.2.0 Search vendor "Oracle" for product "Communications Element Manager" and version "8.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper" | 6.0 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version "6.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper" | 6.1 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version "6.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper" | 7.0 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version "7.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Report Manager Search vendor "Oracle" for product "Communications Session Report Manager" | 8.0.0 Search vendor "Oracle" for product "Communications Session Report Manager" and version "8.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Report Manager Search vendor "Oracle" for product "Communications Session Report Manager" | 8.1.0 Search vendor "Oracle" for product "Communications Session Report Manager" and version "8.1.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Report Manager Search vendor "Oracle" for product "Communications Session Report Manager" | 8.1.1 Search vendor "Oracle" for product "Communications Session Report Manager" and version "8.1.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Report Manager Search vendor "Oracle" for product "Communications Session Report Manager" | 8.2.0 Search vendor "Oracle" for product "Communications Session Report Manager" and version "8.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Route Manager Search vendor "Oracle" for product "Communications Session Route Manager" | 8.0.0 Search vendor "Oracle" for product "Communications Session Route Manager" and version "8.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Route Manager Search vendor "Oracle" for product "Communications Session Route Manager" | 8.1.0 Search vendor "Oracle" for product "Communications Session Route Manager" and version "8.1.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Route Manager Search vendor "Oracle" for product "Communications Session Route Manager" | 8.1.1 Search vendor "Oracle" for product "Communications Session Route Manager" and version "8.1.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Session Route Manager Search vendor "Oracle" for product "Communications Session Route Manager" | 8.2.0 Search vendor "Oracle" for product "Communications Session Route Manager" and version "8.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Data Integrator Search vendor "Oracle" for product "Data Integrator" | 12.2.1.3.0 Search vendor "Oracle" for product "Data Integrator" and version "12.2.1.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Data Integrator Search vendor "Oracle" for product "Data Integrator" | 12.2.1.4.0 Search vendor "Oracle" for product "Data Integrator" and version "12.2.1.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Endeca Information Discovery Integrator Search vendor "Oracle" for product "Endeca Information Discovery Integrator" | 3.2.0 Search vendor "Oracle" for product "Endeca Information Discovery Integrator" and version "3.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Enterprise Manager Base Platform Search vendor "Oracle" for product "Enterprise Manager Base Platform" | 13.2 Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.2" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Enterprise Manager Base Platform Search vendor "Oracle" for product "Enterprise Manager Base Platform" | 13.3 Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.3" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Core Banking Search vendor "Oracle" for product "Flexcube Core Banking" | >= 11.5.0 <= 11.7.0 Search vendor "Oracle" for product "Flexcube Core Banking" and version " >= 11.5.0 <= 11.7.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Core Banking Search vendor "Oracle" for product "Flexcube Core Banking" | 5.2.0 Search vendor "Oracle" for product "Flexcube Core Banking" and version "5.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking" | 12.0.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Flexcube Private Banking Search vendor "Oracle" for product "Flexcube Private Banking" | 12.1.0 Search vendor "Oracle" for product "Flexcube Private Banking" and version "12.1.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Hospitality Guest Access Search vendor "Oracle" for product "Hospitality Guest Access" | 4.2.0 Search vendor "Oracle" for product "Hospitality Guest Access" and version "4.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Hospitality Guest Access Search vendor "Oracle" for product "Hospitality Guest Access" | 4.2.1 Search vendor "Oracle" for product "Hospitality Guest Access" and version "4.2.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Rest Data Services Search vendor "Oracle" for product "Rest Data Services" | 11.2.0.4 Search vendor "Oracle" for product "Rest Data Services" and version "11.2.0.4" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Rest Data Services Search vendor "Oracle" for product "Rest Data Services" | 12.1.0.2 Search vendor "Oracle" for product "Rest Data Services" and version "12.1.0.2" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Rest Data Services Search vendor "Oracle" for product "Rest Data Services" | 12.2.0.1 Search vendor "Oracle" for product "Rest Data Services" and version "12.2.0.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Rest Data Services Search vendor "Oracle" for product "Rest Data Services" | 18c Search vendor "Oracle" for product "Rest Data Services" and version "18c" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service" | 7.1 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "7.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service" | 15.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "15.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service" | 16.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "16.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service" | 17.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "17.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Unified Directory Search vendor "Oracle" for product "Unified Directory" | 12.2.1.3.0 Search vendor "Oracle" for product "Unified Directory" and version "12.2.1.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Unified Directory Search vendor "Oracle" for product "Unified Directory" | 12.2.1.4.0 Search vendor "Oracle" for product "Unified Directory" and version "12.2.1.4.0" | - |
Affected
| ||||||