Read the docs
TI-2019-07561 Aliases CVE-2019-10246GHSA-r28m-g6j9-r2h5

Information disclosure in Eclipse Jetty

Priority LOW 31CWE-213Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Why it matters now

EPSS 0.04094 90th percentileScored 2026-11-07
Fix Fixed org.eclipse.jetty:jetty-server (Maven): 9.2.28.v20190418, 9.3.27.v20190418, 9.4.17.v20190418

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.2.27; 9.3.26; 9.4.16—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)9.2.0 to before 9.2.28.v201904189.2.28.v20190418Patch availableGHSA-r28m-g6j9-r2h5
—org.eclipse.jetty:jetty-server (Maven)9.3.0 to before 9.3.27.v201904189.3.27.v20190418Patch availableGHSA-r28m-g6j9-r2h5
—org.eclipse.jetty:jetty-server (Maven)9.4.0 to before 9.4.17.v201904189.4.17.v20190418Patch availableGHSA-r28m-g6j9-r2h5
  • Eclipse Jetty VendorEclipse Foundation Affected 9.2.27; 9.3.26; 9.4.16 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.2.0 to before 9.2.28.v20190418 Fixed in 9.2.28.v20190418 Patch available GHSA-r28m-g6j9-r2h5
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.0 to before 9.3.27.v20190418 Fixed in 9.3.27.v20190418 Patch available GHSA-r28m-g6j9-r2h5
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.17.v20190418 Fixed in 9.4.17.v20190418 Patch available GHSA-r28m-g6j9-r2h5

CPE configurations NVD · 55

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*9.2.27 20190403VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*9.3.26 20190403VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*9.4.16 20190411VulnerableEclipse Foundation
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*3.0 – 3.1.3VulnerableNetApp
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*9.6VulnerableNetApp
  • cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:* Versions 9.2.27 20190403 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:* Versions 9.3.26 20190403 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:* Versions 9.4.16 20190411 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0 – 3.1.3 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* Versions 9.6 Vulnerable ·NetApp
Show 45 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:*9.6VulnerableNetApp
cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*9.6VulnerableNetApp
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*9.6VulnerableNetApp
cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:*9.6VulnerableNetApp
cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*21.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*6.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*6.1VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*13.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*13.3VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*11.5.0 – 11.7.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*11.2.0.4VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*12.1.0.2VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:* Versions 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·NetApp
  • cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:* Versions 11.5.0 – 11.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* Versions 11.2.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-r28m-g6j9-r2h5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.2.28.v20190418 Advisory →
  • Fix · GHSA-r28m-g6j9-r2h5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.27.v20190418 Advisory →
  • Fix · GHSA-r28m-g6j9-r2h5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.17.v20190418 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10246
  2. 2026-10-03 Alias added: GHSA-r28m-g6j9-r2h5

References

Advisory 9

Other 6

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences