medium
5.3
CWE
200 213
Advisory Published
Updated

CVE-2019-10246: Infoleak

First published: Mon Apr 22 2019(Updated: )

Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by a flaw when configured for showing a listing of directory contents. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to obtain sensitive information.

Credit: emo@eclipse.org

Affected SoftwareAffected VersionHow to fix
Eclipse Jetty=9.2.27-20190403
Eclipse Jetty=9.3.26-20190403
Eclipse Jetty=9.4.16-20190411
Microsoft Windows
NetApp OnCommand System Manager>=3.0<=3.1.3
NetApp Snap Creator Framework
NetApp SnapCenter
netapp snapmanager Oracle
netapp snapmanager sap
NetApp Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere>=9.6
NetApp Storage Replication Adapter=9.6
NetApp Storage Services Connector
NetApp VASA Provider>=9.6
NetApp VASA Provider
NetApp Virtual Storage Console for VMware vSphere>=9.6
NetApp Virtual Storage Console=9.6
NetApp Element Plug-in for vCenter Server
Oracle AutoVue=21.0.2
oracle communications analytics=12.1.1
oracle communications element manager=8.0.0
oracle communications element manager=8.1.0
oracle communications element manager=8.1.1
oracle communications element manager=8.2.0
Oracle Communications Services Gatekeeper=6.0
Oracle Communications Services Gatekeeper=6.1
Oracle Communications Services Gatekeeper=7.0
oracle communications session report manager=8.0.0
oracle communications session report manager=8.1.0
oracle communications session report manager=8.1.1
oracle communications session report manager=8.2.0
oracle communications session route manager=8.0.0
oracle communications session route manager=8.1.0
oracle communications session route manager=8.1.1
oracle communications session route manager=8.2.0
Oracle Data Integrator=12.2.1.3.0
Oracle Data Integrator=12.2.1.4.0
Oracle Endeca Information Discovery Integrator=3.2.0
Oracle Enterprise Manager Base Platform=13.2
Oracle Enterprise Manager Base Platform=13.3
Oracle FLEXCUBE Core Banking>=11.5.0<=11.7.0
Oracle FLEXCUBE Core Banking=5.2.0
Oracle FLEXCUBE Private Banking=12.0.0
Oracle FLEXCUBE Private Banking=12.1.0
Oracle Hospitality Guest Access=4.2.0
Oracle Hospitality Guest Access=4.2.1
Oracle REST Data Services=11.2.0.4
Oracle REST Data Services=12.1.0.2
Oracle REST Data Services=12.2.0.1
Oracle REST Data Services=18c
Oracle Retail Xstore Office Cloud Service=7.1
Oracle Retail Xstore Office Cloud Service=15.0
Oracle Retail Xstore Office Cloud Service=16.0
Oracle Retail Xstore Office Cloud Service=17.0
Oracle Unified Directory=12.2.1.3.0
Oracle Unified Directory=12.2.1.4.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID for this Eclipse Jetty vulnerability?

    The vulnerability ID for this Eclipse Jetty vulnerability is CVE-2019-10246.

  • What is the severity level of CVE-2019-10246?

    The severity level of CVE-2019-10246 is medium (5.3).

  • Which software versions are affected by CVE-2019-10246?

    Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16 are affected by CVE-2019-10246.

  • How can a remote attacker exploit this vulnerability in Eclipse Jetty?

    A remote attacker can exploit this vulnerability in Eclipse Jetty to obtain sensitive information by exposing the fully qualified Base Resource directory name on Windows to a remote client when the server is configured for showing a Listing of directory contents.

  • Are Windows servers vulnerable to CVE-2019-10246?

    No, Windows servers are not vulnerable to CVE-2019-10246.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203