Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTd2eDkteGpoci1ydzZo

Cross-site Scripting in Eclipse Jetty

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Permalink: https://github.com/advisories/GHSA-7vx9-xjhr-rw6h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTd2eDkteGpoci1ydzZo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago


CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00336
EPSS Percentile: 0.70928

Identifiers: GHSA-7vx9-xjhr-rw6h, CVE-2019-10241
References: Blast Radius: 27.7

Affected Packages

maven:org.eclipse.jetty:jetty-server
Dependent packages: 3,819
Dependent repositories: 34,580
Downloads:
Affected Version Ranges: >= 9.4.0, <= 9.4.15.v20190215, >= 9.3.0, <= 9.3.25.v20180904, <= 9.2.26.v20180806
Fixed in: 9.4.16.v20190411, 9.3.26.v20190403, 9.2.27.v20190403
All affected versions: 9.2.2-0.v20161216, 9.2.2-1.v20170120, 9.2.2-2.v20170606, 9.2.2-3.v20171218, 9.2.2-4.v20180105, 9.2.2-5.v20180606, 9.2.2-6.v20180806, 9.3.2-0.v20170531, 9.3.2-1.M0, 9.3.2-1.RC0, 9.3.2-1.v20170918, 9.3.2-2.v20171030, 9.3.2-3.v20180228, 9.3.2-4.v20180605, 9.3.2-5.v20180904, 9.4.1-0.RC0, 9.4.1-0.RC1, 9.4.1-0.v20180503, 9.4.1-1.v20180605, 9.4.1-2.RC0, 9.4.1-2.RC1, 9.4.1-2.RC2, 9.4.1-2.v20180830, 9.4.1-3.v20181111, 9.4.1-4.v20181114, 9.4.1-5.v20190215
All unaffected versions: 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.16, 10.0.17, 10.0.18, 10.0.19, 10.0.20, 10.0.21, 10.0.22, 10.0.23, 10.0.24, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.14, 11.0.15, 11.0.16, 11.0.17, 11.0.18, 11.0.19, 11.0.20, 11.0.21, 11.0.22, 11.0.23, 11.0.24, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9, 12.0.10, 12.0.11, 12.0.12, 12.0.13, 12.0.14, 12.0.15