CVE-2019-10246
Information Exposure vulnerability in Eclipse Jetty
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Record
CVE-2019-10246- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-213, CWE-200
- Updated
- 2026-11-02
CVE List No score
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Record
CVE-2019-10246- Weakness
- CWE-213
- Updated
- 2026-11-02
EUVDEUVD-2019-0430 No score
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Record
EUVD-2019-0430- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r28m-g6j9-r2h5
Information Exposure vulnerability in Eclipse Jetty
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Record
GHSA-r28m-g6j9-r2h5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-213
- Updated
- 2026-11-02
OSV
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Record
CVE-2019-10246- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-r28m-g6j9-r2h5
Information Exposure vulnerability in Eclipse Jetty
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Record
GHSA-r28m-g6j9-r2h5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-213
- Updated
- 2026-11-02
Affected products
- eclipse jetty
- eclipse foundation jetty
- the eclipse foundation eclipse jetty
- netapp element
- netapp oncommand system manager
- netapp snap creator framework
- netapp snapcenter
- netapp snapmanager
- netapp storage replication adapter for clustered data ontap
- netapp storage services connector
- netapp vasa provider for clustered data ontap
- netapp virtual storage console
Show 15 moreShow less
- oracle autovue
- oracle communications analytics
- oracle communications element manager
- oracle communications services gatekeeper
- oracle communications session report manager
- oracle communications session route manager
- oracle data integrator
- oracle endeca information discovery integrator
- oracle enterprise manager base platform
- oracle flexcube core banking
- oracle flexcube private banking
- oracle hospitality guest access
- oracle rest data services
- oracle retail xstore point of service
- oracle unified directory
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-serverMaven |
9.2.0 to 9.2.27.v20190403 | 9.2.28.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.3.0 to 9.3.26.v20190403 | 9.3.27.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.4.0 to 9.4.16.v20190411 | 9.4.17.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.2.0 up to 9.2.28.v20190418, plus listed versions 9.2.0.v201405269.2.1.v201406099.2.10.v201503109.2.11.M09.2.11.v20150529 Show 25 moreShow less9.2.12.M09.2.12.v201507099.2.13.v201507309.2.14.v201511069.2.15.v201602109.2.16.v201604149.2.17.v201605179.2.18.v201607219.2.19.v201609089.2.2.v201407239.2.20.v201612169.2.21.v201701209.2.22.v201706069.2.23.v201712189.2.24.v201801059.2.25.v201806069.2.26.v201808069.2.27.v201904039.2.3.v201409059.2.4.v201411039.2.5.v201411129.2.6.v201412059.2.7.v201501169.2.8.v201502179.2.9.v20150224 |
9.2.28.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.3.0 up to 9.3.27.v20190418, plus listed versions 9.3.0.v201506129.3.1.v201507149.3.10.M09.3.10.v201606219.3.11.M0 Show 35 moreShow less9.3.11.v201607219.3.12.v201609159.3.13.M09.3.13.v201610149.3.14.v201610289.3.15.v201612209.3.16.v201701209.3.17.RC09.3.17.v201703179.3.18.v201704069.3.19.v201705029.3.2.v201507309.3.20.v201705319.3.21.M09.3.21.RC09.3.21.v201709189.3.22.v201710309.3.23.v201802289.3.24.v201806059.3.25.v201809049.3.26.v201904039.3.3.v201508279.3.4.RC09.3.4.RC19.3.4.v201510079.3.5.v201510129.3.6.v201511069.3.7.RC09.3.7.RC19.3.7.v201601159.3.8.RC09.3.8.v201603149.3.9.M09.3.9.M19.3.9.v20160517 |
9.3.27.v20190418 |
org.eclipse.jetty:jetty-serverMaven |
9.4.0 up to 9.4.17.v20190418, plus listed versions 9.4.0.v201612089.4.0.v201806199.4.1.v201701209.4.1.v201806199.4.10.RC0 Show 27 moreShow less9.4.10.RC19.4.10.v201805039.4.11.v201806059.4.12.RC09.4.12.RC19.4.12.RC29.4.12.v201808309.4.13.v201811119.4.14.v201811149.4.15.v201902159.4.16.v201904119.4.2.v201702209.4.2.v201806199.4.3.v201703179.4.3.v201806199.4.4.v201704149.4.4.v201806199.4.5.v201705029.4.5.v201806199.4.6.v201705319.4.6.v201806199.4.7.RC09.4.7.v201709149.4.7.v201806199.4.8.v201711219.4.8.v201806199.4.9.v20180320 |
9.4.17.v20190418 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10246 is a medium vulnerability (CVSS 5.3) in Eclipse Jetty, published April 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.09%, the 90th percentile. Fixed in org.eclipse.jetty:jetty-server 9.2.28.v20190418.
References
lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
oracle.com/security-alerts/cpuapr2020.html
Show 9 moreShow less
bugs.eclipse.org/bugs/show_bug.cgi?id=546576
security.netapp.com/advisory/ntap-20190509-0003
nvd.nist.gov/vuln/detail/CVE-2019-10246
github.com/advisories/GHSA-r28m-g6j9-r2h5