Read the docs
TI-2018-08995 Aliases CVE-2018-12536GHSA-9rgv-h7x4-qw8g

Information disclosure through error messages in Eclipse Jetty

Priority LOW 31CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.

Summary

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

Why it matters now

EPSS 0.04235 91st percentileScored 2026-11-07
Fix Partial Eclipse Jetty (The Eclipse Foundation): 9.3.24, 9.4.11org.eclipse.jetty:jetty-server (Maven): 9.4.11.v20180605, 9.3.24.v20180605Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jettyup to 9.2.0; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.119.3.24, 9.4.11Patch availableCNA
—org.eclipse.jetty:jetty-server (Maven)9.4.0 to before 9.4.11.v201806059.4.11.v20180605Patch availableGHSA-9rgv-h7x4-qw8g
—org.eclipse.jetty:jetty-server (Maven)9.0.0 to before 9.3.24.v201806059.3.24.v20180605Patch availableGHSA-9rgv-h7x4-qw8g
  • Eclipse Jetty VendorEclipse Foundation Affected up to 9.2.0; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 Fixed in 9.3.24, 9.4.11 Patch available CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.11.v20180605 Fixed in 9.4.11.v20180605 Patch available GHSA-9rgv-h7x4-qw8g
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.0.0 to before 9.3.24.v20180605 Fixed in 9.3.24.v20180605 Patch available GHSA-9rgv-h7x4-qw8g

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.0.0 – 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11VulnerableEclipse Foundation
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.0:*:*:*:*:*:*:*16.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.0.0 – 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.0:*:*:*:*:*:*:* Versions 16.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA Eclipse Jetty (The Eclipse Foundation) Fixed in 9.3.24, 9.4.11
  • Fix · GHSA-9rgv-h7x4-qw8g org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.11.v20180605 Advisory →
  • Fix · GHSA-9rgv-h7x4-qw8g org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.24.v20180605 Advisory →

Red Hat 1 advisory

  • RHSA-2020:0983 Released 2020-03-26 · Red Hat rating Important
    Red Hat Fuse 7.6.0 security update
    • Red Hat Fuse 7.6.0

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Fuse 7.6.0Fixed RHSA-2020:0983
Not affected: 1 product
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12536
  2. 2026-10-03 Alias added: GHSA-9rgv-h7x4-qw8g

References

Patch 1

Advisory 4

Other 7

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences