CVE-2019-10247
Installation information leak in Eclipse Jetty
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
CVE-2019-10247- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-213, CWE-200
- Updated
- 2026-11-02
CVE List No score
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
CVE-2019-10247- Weakness
- CWE-213
- Updated
- 2026-11-02
EUVDEUVD-2019-0440 No score
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
EUVD-2019-0440- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xc67-hjx6-cgg6
Installation information leak in Eclipse Jetty
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
GHSA-xc67-hjx6-cgg6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-213
- Updated
- 2026-11-02
OSV
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
CVE-2019-10247- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10247
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
DEBIAN-CVE-2019-10247- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-xc67-hjx6-cgg6
Installation information leak in Eclipse Jetty
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
GHSA-xc67-hjx6-cgg6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-213
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10247
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
- Record
UBUNTU-CVE-2019-10247- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1768522122 No score
TuxCare security update for org.eclipse.jetty (4 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 4 CVEs. Fixed in 8.2.0.v20160908-tuxcare.1.
- Record
CLSA-2026-1768522122- Updated
- 2026-11-02
OSVCLSA-2026-1778201084 No score
TuxCare security update for org.eclipse.jetty (6 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 6 CVEs. Fixed in 7.6.0.v20120127-tuxcare.1.
- Record
CLSA-2026-1778201084- Updated
- 2026-11-02
OSVCLSA-2026-1792769441 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.2.16.v20160414-tuxcare.2.
- Record
CLSA-2026-1792769441- Updated
- 2026-11-02
Affected products
- eclipse jetty
- eclipse foundation jetty
- the eclipse foundation eclipse jetty
- debian linux
- netapp element
- netapp oncommand system manager
- netapp snap creator framework
- netapp snapcenter
- netapp snapmanager
- netapp storage replication adapter for clustered data ontap
- netapp storage services connector
- netapp vasa provider for clustered data ontap
Show 16 moreShow less
- netapp virtual storage console
- oracle autovue
- oracle communications analytics
- oracle communications element manager
- oracle communications services gatekeeper
- oracle communications session report manager
- oracle communications session route manager
- oracle data integrator
- oracle endeca information discovery integrator
- oracle enterprise manager base platform
- oracle flexcube core banking
- oracle flexcube private banking
- oracle fmw platform
- oracle hospitality guest access
- oracle retail xstore point of service
- oracle unified directory
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-serverMaven |
7.0.0 to 9.2.27.v20190403 | 9.2.28.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.3.0 to 9.3.26.v20190403 | 9.3.27.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.4.0 to 9.4.16.v20190411 | 9.4.17.v20190418 |
org.eclipse.jetty:jetty-serverTuxCare:Maven |
8.2.0.v20160908 up to 8.2.0.v20160908-tuxcare.1 | 8.2.0.v20160908-tuxcare.1 |
org.eclipse.jetty:jetty-webappTuxCare:Maven |
8.2.0.v20160908 up to 8.2.0.v20160908-tuxcare.1 | 8.2.0.v20160908-tuxcare.1 |
org.eclipse.jetty:jetty-serverTuxCare:Maven |
7.6.0.v20120127 up to 7.6.0.v20120127-tuxcare.1 | 7.6.0.v20120127-tuxcare.1 |
org.eclipse.jetty:jetty-servletsTuxCare:Maven |
7.6.0.v20120127 up to 7.6.0.v20120127-tuxcare.1 | 7.6.0.v20120127-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
9.2.16.v20160414 up to 9.2.16.v20160414-tuxcare.2, plus listed versions 9.2.16.v20160414-tuxcare.1 |
9.2.16.v20160414-tuxcare.2 |
org.eclipse.jetty:jetty-serverTuxCare:Maven |
9.2.16.v20160414 up to 9.2.16.v20160414-tuxcare.2, plus listed versions 9.2.16.v20160414-tuxcare.1 |
9.2.16.v20160414-tuxcare.2 |
jetty9Debian:12 |
before 9.4.18-2 | 9.4.18-2 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jetty9Debian:13 |
before 9.4.18-2 | 9.4.18-2 |
jetty9Debian:14 |
before 9.4.18-2 | 9.4.18-2 |
jetty9Debian:9 |
before 9.2.30-0+deb9u1, plus listed versions 9.2.21-19.2.21-1+deb9u19.2.22-19.2.22-29.2.22-3 Show 8 moreShow less9.2.23-19.2.23-1~bpo8+19.2.23-1~bpo9+19.2.24-19.2.24-1~bpo9+19.2.25-19.2.26-19.2.26-1~bpo9+1 |
9.2.30-0+deb9u1 |
jetty9Debian:10 |
before 9.4.16-0+deb10u1, plus listed versions 9.4.15-1 |
9.4.16-0+deb10u1 |
org.eclipse.jetty:jetty-serverMaven |
7.0.0 up to 9.2.28.v20190418, plus listed versions 7.0.0.v200910057.0.1.v200911257.0.2.RC07.0.2.v201003317.1.0.RC0 Show 45 moreShow less7.1.0.RC17.1.0.v201005057.1.1.v201005177.1.2.v201005237.1.3.v201005267.1.4.v201006107.1.5.v201007057.1.6.v201007157.2.0.RC07.2.0.v201010207.2.1.v201011117.2.2.v201012057.3.0.v201102037.3.1.v201103077.4.0.RC07.4.0.v201104147.4.1.v201105137.4.2.v201105267.4.3.v201107017.4.4.v201107077.4.5.v201107257.5.0.RC07.5.0.RC17.5.0.RC27.5.0.v201109017.5.1.v201109087.5.2.v201110067.5.3.v201110117.5.4.v201110247.6.0.RC07.6.0.RC17.6.0.RC27.6.0.RC37.6.0.RC47.6.0.RC57.6.0.v201201277.6.1.v201202157.6.10.v201303127.6.11.v201305207.6.12.v201307267.6.13.v201309167.6.14.v201310317.6.15.v201404117.6.16.v201409037.6.17.v20150415 |
9.2.28.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.3.0 up to 9.3.27.v20190418, plus listed versions 9.3.0.v201506129.3.1.v201507149.3.10.M09.3.10.v201606219.3.11.M0 Show 35 moreShow less9.3.11.v201607219.3.12.v201609159.3.13.M09.3.13.v201610149.3.14.v201610289.3.15.v201612209.3.16.v201701209.3.17.RC09.3.17.v201703179.3.18.v201704069.3.19.v201705029.3.2.v201507309.3.20.v201705319.3.21.M09.3.21.RC09.3.21.v201709189.3.22.v201710309.3.23.v201802289.3.24.v201806059.3.25.v201809049.3.26.v201904039.3.3.v201508279.3.4.RC09.3.4.RC19.3.4.v201510079.3.5.v201510129.3.6.v201511069.3.7.RC09.3.7.RC19.3.7.v201601159.3.8.RC09.3.8.v201603149.3.9.M09.3.9.M19.3.9.v20160517 |
9.3.27.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.4.0 up to 9.4.17.v20190418, plus listed versions 9.4.0.v201612089.4.0.v201806199.4.1.v201701209.4.1.v201806199.4.10.RC0 Show 27 moreShow less9.4.10.RC19.4.10.v201805039.4.11.v201806059.4.12.RC09.4.12.RC19.4.12.RC29.4.12.v201808309.4.13.v201811119.4.14.v201811149.4.15.v201902159.4.16.v201904119.4.2.v201702209.4.2.v201806199.4.3.v201703179.4.3.v201806199.4.4.v201704149.4.4.v201806199.4.5.v201705029.4.5.v201806199.4.6.v201705319.4.6.v201806199.4.7.RC09.4.7.v201709149.4.7.v201806199.4.8.v201711219.4.8.v201806199.4.9.v20180320 |
9.4.17.v20190418 |
jettyUbuntu:14.04:LTS |
All versions, plus listed versions 6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2 |
None known |
jetty8Ubuntu:14.04:LTS |
All versions, plus listed versions 8.1.3-88.1.3-9 |
None known |
jettyUbuntu:16.04:LTS |
All versions, plus listed versions 6.1.26-56.1.26-5ubuntu0.1 |
None known |
jetty8Ubuntu:16.04:LTS |
All versions, plus listed versions 8.1.17-28.1.18-18.1.18-28.1.18-38.1.19-1 |
None known |
jetty9Ubuntu:16.04:LTS |
All versions, plus listed versions 9.2.14-1 |
None known |
jetty9Ubuntu:18.04:LTS |
All versions, plus listed versions 9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1 |
None known |
jetty9Ubuntu:20.04:LTS |
All versions, plus listed versions 9.4.18-2build29.4.26-1 |
None known |
jetty9Ubuntu:22.04:LTS |
All versions, plus listed versions 9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1 |
None known |
jetty9Ubuntu:24.04:LTS |
All versions, plus listed versions 9.4.51-29.4.53-1 |
None known |
jetty9Ubuntu:25.10 |
All versions, plus listed versions 9.4.56-19.4.57-1 |
None known |
jetty9Ubuntu:26.10 |
All versions, plus listed versions 9.4.58-19.4.58-2 |
None known |
jetty9Ubuntu:26.04:LTS |
All versions, plus listed versions 9.4.57-19.4.57-1.19.4.58-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10247 is a medium vulnerability (CVSS 5.3) in Eclipse Jetty, published April 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.94%, the 93rd percentile. Fixed in org.eclipse.jetty:jetty-server 9.2.28.v20190418.
References
lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E
Show 23 moreShow less
oracle.com/security-alerts/cpuapr2020.html
security.netapp.com/advisory/ntap-20190509-0003
bugs.eclipse.org/bugs/show_bug.cgi?id=546577
lists.debian.org/debian-lts-announce/2021/05/msg00016.html
debian.org/security/2021/dsa-4949
nvd.nist.gov/vuln/detail/CVE-2019-10247
github.com/advisories/GHSA-xc67-hjx6-cgg6
security-tracker.debian.org/tracker/CVE-2019-10247
ubuntu.com/security/CVE-2019-10247
cve.org/CVERecord?id=CVE-2019-10247
Left out here: 112 versions. The JSON record has them.