← Back

CVE-2019-10246

nvd nist
Published: Apr 22, 2019Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Affected (54)

Eclipse
1 product
Jetty
Netapp
9 products
Element
Oncommand System Manager
Snap Creator Framework
Snapcenter
Snapmanager
Storage Replication Adapter For Clustered Data Ontap
Storage Services Connector
Vasa Provider For Clustered Data Ontap
Virtual Storage Console
Oracle
15 products
Autovue
Communications Analytics
Communications Element Manager
Communications Services Gatekeeper
Communications Session Report Manager
Communications Session Route Manager
Data Integrator
Endeca Information Discovery Integrator
Enterprise Manager Base Platform
Flexcube Core Banking
Flexcube Private Banking
Hospitality Guest Access
Rest Data Services
Retail Xstore Point Of Service
Unified Directory
Configuration A
3 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Eclipse
Jetty
Version 9.2.27 20190403
Jetty
Version 9.3.26 20190403
Jetty
Version 9.4.16 20190411
Running on/withPlatform Versions
Microsoft
Windows
All versions
Configuration B
13 vulnerable
Vulnerable SoftwareAffected Versions
Element
All versions
Oncommand System Manager
From 3.0 to 3.1.3
Snap Creator Framework
All versions
Snapcenter
All versions
Netapp
Snapmanager
All versions
Snapmanager
All versions
Netapp
Storage Replication Adapter For Clustered Data Ontap
From 9.6
Storage Replication Adapter For Clustered Data Ontap
Version 9.6
Storage Services Connector
All versions
Netapp
Vasa Provider For Clustered Data Ontap
From 9.6
Vasa Provider For Clustered Data Ontap
All versions
Netapp
Virtual Storage Console
From 9.6
Virtual Storage Console
Version 9.6
Configuration C
38 vulnerable
Vulnerable SoftwareAffected Versions
Autovue
Version 21.0.2
Communications Analytics
Version 12.1.1
Oracle
Communications Element Manager
Version 8.0.0
Communications Element Manager
Version 8.1.0
Communications Element Manager
Version 8.1.1
Communications Element Manager
Version 8.2.0
Oracle
Communications Services Gatekeeper
Version 6.0
Communications Services Gatekeeper
Version 6.1
Communications Services Gatekeeper
Version 7.0
Oracle
Communications Session Report Manager
Version 8.0.0
Communications Session Report Manager
Version 8.1.0
Communications Session Report Manager
Version 8.1.1
Communications Session Report Manager
Version 8.2.0
Oracle
Communications Session Route Manager
Version 8.0.0
Communications Session Route Manager
Version 8.1.0
Communications Session Route Manager
Version 8.1.1
Communications Session Route Manager
Version 8.2.0
Oracle
Data Integrator
Version 12.2.1.3.0
Data Integrator
Version 12.2.1.4.0
Endeca Information Discovery Integrator
Version 3.2.0
Oracle
Enterprise Manager Base Platform
Version 13.2
Enterprise Manager Base Platform
Version 13.3
Oracle
Flexcube Core Banking
From 11.5.0 to 11.7.0
Flexcube Core Banking
Version 5.2.0
Oracle
Flexcube Private Banking
Version 12.0.0
Flexcube Private Banking
Version 12.1.0
Oracle
Hospitality Guest Access
Version 4.2.0
Hospitality Guest Access
Version 4.2.1
Oracle
Rest Data Services
Version 11.2.0.4
Rest Data Services
Version 12.1.0.2
Rest Data Services
Version 12.2.0.1
Rest Data Services
Version 18c
Oracle
Retail Xstore Point Of Service
Version 15.0
Retail Xstore Point Of Service
Version 16.0
Retail Xstore Point Of Service
Version 17.0
Retail Xstore Point Of Service
Version 7.1
Oracle
Unified Directory
Version 12.2.1.3.0
Unified Directory
Version 12.2.1.4.0

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-213
Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

References (22)

Source: emo@eclipse.org
Issue TrackingVendor Advisory
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.