Read the docs
TI-2019-13157 Aliases CVE-2019-17632GHSA-5h9j-q6j2-253f

Cross-site scripting in Eclipse Jetty

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Why it matters now

EPSS 0.01905 79th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.24.v20191120Red Hat: 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.4.21.v20190926; 9.4.22.v20191022; 9.4.23.v20191118—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)9.4.21.v20190926 to before 9.4.24.v201911209.4.24.v20191120Patch availableGHSA-5h9j-q6j2-253f
—org.eclipse.jetty:jetty-server (Maven)9.4.22.v20191022 to before 9.4.24.v201911209.4.24.v20191120Patch availableGHSA-5h9j-q6j2-253f
—org.eclipse.jetty:jetty-server (Maven)9.4.23.v20191118 to before 9.4.24.v201911209.4.24.v20191120Patch availableGHSA-5h9j-q6j2-253f
  • Eclipse Jetty VendorEclipse Foundation Affected 9.4.21.v20190926; 9.4.22.v20191022; 9.4.23.v20191118 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.21.v20190926 to before 9.4.24.v20191120 Fixed in 9.4.24.v20191120 Patch available GHSA-5h9j-q6j2-253f
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.22.v20191022 to before 9.4.24.v20191120 Fixed in 9.4.24.v20191120 Patch available GHSA-5h9j-q6j2-253f
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.23.v20191118 to before 9.4.24.v20191120 Fixed in 9.4.24.v20191120 Patch available GHSA-5h9j-q6j2-253f

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:9.4.21:20190926:*:*:*:*:*:*9.4.21 20190926VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.22:20191022:*:*:*:*:*:*9.4.22 20191022VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.23:20191118:*:*:*:*:*:*9.4.23 20191118VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.21:20190926:*:*:*:*:*:* Versions 9.4.21 20190926 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.22:20191022:*:*:*:*:*:* Versions 9.4.22 20191022 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.23:20191118:*:*:*:*:*:* Versions 9.4.23 20191118 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-5h9j-q6j2-253f org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.24.v20191120 Advisory →
  • Fix · GHSA-5h9j-q6j2-253f org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.24.v20191120 Advisory →
  • Fix · GHSA-5h9j-q6j2-253f org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.24.v20191120 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Satellite 5AffectedNo fix planned: Out of support scope
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Fuse 7
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17632
  2. 2026-10-03 Alias added: GHSA-5h9j-q6j2-253f

References

Advisory 3

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences