p PatchFirst

CVE-2019-10241

CVE-2019-10241

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

CVSS 6.1 · Medium · EPSS 9.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ unspecified, ≤ 9.2.26: Affected (custom)
    • ≥ unspecified, ≤ 9.3.25: Affected (custom)
    • ≥ unspecified, ≤ 9.4.15: Affected (custom)

    No fix published

  • jetty9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.4.18-2

    Update to 9.4.18-2

  • jetty9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.4.18-2

    Update to 9.4.18-2

  • jetty9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.4.18-2

    Update to 9.4.18-2

  • jetty Ubuntu:14.04:LTS

    Versions
    • 6.1.26-1ubuntu1
    • 6.1.26-1ubuntu1.1
    • 6.1.26-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty8 Ubuntu:14.04:LTS

    Versions
    • 8.1.3-8
    • 8.1.3-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty Ubuntu:16.04:LTS

    Versions
    • 6.1.26-5
    • 6.1.26-5ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty8 Ubuntu:16.04:LTS

    Versions
    • 8.1.17-2
    • 8.1.18-1
    • 8.1.18-2
    • 8.1.18-3
    • 8.1.19-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:18.04:LTS

    Versions
    • 9.2.22-2
    • 9.2.22-3
    • 9.2.23-1
    • 9.4.15-1~18.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →