← Back

CVE-2019-10241

nvd nist
Published: Apr 22, 2019Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Affected (139)

Products: Eclipse: Jetty · Debian: Debian Linux · Apache: Activemq, Drill · +1 more
Show all products
Eclipse: Jetty · Debian: Debian Linux · Apache: Activemq, Drill · Oracle: Flexcube Core Banking, Rest Data Services, Retail Xstore Point Of Service
Eclipse
1 product
Jetty
Debian
1 product
Debian Linux
Apache
2 products
Activemq
Drill
Oracle
3 products
Flexcube Core Banking
Rest Data Services
Retail Xstore Point Of Service
Configuration A
125 vulnerable
Vulnerable SoftwareAffected Versions
Eclipse
Jetty
Version 9.2.0 20140523
Jetty
Version 9.2.0 20140526
Jetty
Version 9.2.0 maintenance_0
Jetty
Version 9.2.0 maintenance_1
Jetty
Version 9.2.0 rc0
Jetty
Version 9.2.10 20150310
Jetty
Version 9.2.11 20150528
Jetty
Version 9.2.11 20150529
Jetty
Version 9.2.11 maintenance_0
Jetty
Version 9.2.12 20150709
Jetty
Version 9.2.12 maintenance_0
Jetty
Version 9.2.13 20150730
Jetty
Version 9.2.14 20151106
Jetty
Version 9.2.15 20160210
Jetty
Version 9.2.16 20160407
Jetty
Version 9.2.16 20160414
Jetty
Version 9.2.17 20160517
Jetty
Version 9.2.18 20160721
Jetty
Version 9.2.19 20160908
Jetty
Version 9.2.1 20140609
Jetty
Version 9.2.20 20161216
Jetty
Version 9.2.21 20170120
Jetty
Version 9.2.22 20170606
Jetty
Version 9.2.23 20171218
Jetty
Version 9.2.24 20180105
Jetty
Version 9.2.25 20180606
Jetty
Version 9.2.26 20180806
Jetty
Version 9.2.2 20140723
Jetty
Version 9.2.3 20140905
Jetty
Version 9.2.4 20141103
Jetty
Version 9.2.5 20141112
Jetty
Version 9.2.6 20141203
Jetty
Version 9.2.6 20141205
Jetty
Version 9.2.7 20150116
Jetty
Version 9.2.8 20150217
Jetty
Version 9.2.9 20150224
Jetty
Version 9.3.0 20150601
Jetty
Version 9.3.0 20150608
Jetty
Version 9.3.0 20150612
Jetty
Version 9.3.0 maintenance0
Jetty
Version 9.3.0 maintenance1
Jetty
Version 9.3.0 maintenance2
Jetty
Version 9.3.0 rc0
Jetty
Version 9.3.0 rc1
Jetty
Version 9.3.10 20160621
Jetty
Version 9.3.10 maintenance_0
Jetty
Version 9.3.11 20160721
Jetty
Version 9.3.11 maintenance_0
Jetty
Version 9.3.12 20160915
Jetty
Version 9.3.13 20161014
Jetty
Version 9.3.13 maintenance_0
Jetty
Version 9.3.14 20161028
Jetty
Version 9.3.15 20161220
Jetty
Version 9.3.16 20170119
Jetty
Version 9.3.16 20170120
Jetty
Version 9.3.17 20170317
Jetty
Version 9.3.17 rc0
Jetty
Version 9.3.18 20170406
Jetty
Version 9.3.19 20170502
Jetty
Version 9.3.1 20150714
Jetty
Version 9.3.20 20170531
Jetty
Version 9.3.21 20170918
Jetty
Version 9.3.21 maintenance_0
Jetty
Version 9.3.21 rc0
Jetty
Version 9.3.22 20171030
Jetty
Version 9.3.23 20180228
Jetty
Version 9.3.24 20180605
Jetty
Version 9.3.25 20180904
Jetty
Version 9.3.2 20150730
Jetty
Version 9.3.3 20150825
Jetty
Version 9.3.3 20150827
Jetty
Version 9.3.4 20151005
Jetty
Version 9.3.4 20151007
Jetty
Version 9.3.4 rc0
Jetty
Version 9.3.4 rc1
Jetty
Version 9.3.5 20151012
Jetty
Version 9.3.6 20151106
Jetty
Version 9.3.7 20160115
Jetty
Version 9.3.7 rc0
Jetty
Version 9.3.7 rc1
Jetty
Version 9.3.8 20160311
Jetty
Version 9.3.8 20160314
Jetty
Version 9.3.8 rc0
Jetty
Version 9.3.9 20160517
Jetty
Version 9.3.9 maintenance_0
Jetty
Version 9.3.9 maintenance_1
Jetty
Version 9.4.0 20161207
Jetty
Version 9.4.0 20161208
Jetty
Version 9.4.0 20180619
Jetty
Version 9.4.0 maintenance_0
Jetty
Version 9.4.0 maintenance_1
Jetty
Version 9.4.0 rc0
Jetty
Version 9.4.0 rc1
Jetty
Version 9.4.0 rc2
Jetty
Version 9.4.0 rc3
Jetty
Version 9.4.10 20180503
Jetty
Version 9.4.10 rc0
Jetty
Version 9.4.10 rc1
Jetty
Version 9.4.11 20180605
Jetty
Version 9.4.12 20180830
Jetty
Version 9.4.12 rc0
Jetty
Version 9.4.12 rc1
Jetty
Version 9.4.12 rc2
Jetty
Version 9.4.13 20181111
Jetty
Version 9.4.14 20181114
Jetty
Version 9.4.15 20190215
Jetty
Version 9.4.1 20170120
Jetty
Version 9.4.1 20180619
Jetty
Version 9.4.2 20170220
Jetty
Version 9.4.2 20180619
Jetty
Version 9.4.3 20170317
Jetty
Version 9.4.3 20180619
Jetty
Version 9.4.4 20170410
Jetty
Version 9.4.4 20170414
Jetty
Version 9.4.4 20180619
Jetty
Version 9.4.5 20170502
Jetty
Version 9.4.5 20180619
Jetty
Version 9.4.6 20170531
Jetty
Version 9.4.6 20180619
Jetty
Version 9.4.7 20170914
Jetty
Version 9.4.7 20180619
Jetty
Version 9.4.7 rc0
Jetty
Version 9.4.8 20171121
Jetty
Version 9.4.8 20180619
Jetty
Version 9.4.9 20180320
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Activemq
Version 5.15.9
Drill
Version 1.16.0
Configuration D
10 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Flexcube Core Banking
From 11.5.0 to 11.7.0
Flexcube Core Banking
Version 5.2.0
Oracle
Rest Data Services
Version 11.2.0.4
Rest Data Services
Version 12.1.0.2
Rest Data Services
Version 12.2.0.1
Rest Data Services
Version 18c
Oracle
Retail Xstore Point Of Service
Version 15.0
Retail Xstore Point Of Service
Version 16.0
Retail Xstore Point Of Service
Version 17.0
Retail Xstore Point Of Service
Version 7.1

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (30)

Source: emo@eclipse.org
Issue TrackingVendor Advisory
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Mailing ListThird Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
PatchThird Party Advisory
Source: emo@eclipse.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.