CVE-2019-17632

Published: Nov 25, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Affected (3)

Products: Eclipse: Jetty

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Eclipse Jetty	Version 9.4.21 20190926
Eclipse Jetty	Version 9.4.22 20191022
Eclipse Jetty	Version 9.4.23 20191118

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443

Source: emo@eclipse.org

Issue TrackingVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/

Source: emo@eclipse.org

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: emo@eclipse.org

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: emo@eclipse.org

https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.