{"id":"CVE-2019-10246","aliases":["EUVD-2019-0430","GHSA-r28m-g6j9-r2h5"],"status":"published","title":"Information Exposure vulnerability in Eclipse Jetty","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04094,"percentile":0.90825,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-213"],"published":"2019-04-22T20:14:49Z","modified":"2026-10-24T10:30:53Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["9.2.28.v20190418","9.3.27.v20190418","9.4.17.v20190418"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.2.0"},{"last_affected":"9.2.27.v20190403"},{"fixed":"9.2.28.v20190418"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"last_affected":"9.3.26.v20190403"},{"fixed":"9.3.27.v20190418"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"last_affected":"9.4.16.v20190411"},{"fixed":"9.4.17.v20190418"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.2.0"},{"fixed":"9.2.28.v20190418"}]}],"versions":["9.2.0.v20140526","9.2.1.v20140609","9.2.10.v20150310","9.2.11.M0","9.2.11.v20150529","9.2.12.M0","9.2.12.v20150709","9.2.13.v20150730","9.2.14.v20151106","9.2.15.v20160210","9.2.16.v20160414","9.2.17.v20160517","9.2.18.v20160721","9.2.19.v20160908","9.2.2.v20140723","9.2.20.v20161216","9.2.21.v20170120","9.2.22.v20170606","9.2.23.v20171218","9.2.24.v20180105","9.2.25.v20180606","9.2.26.v20180806","9.2.27.v20190403","9.2.3.v20140905","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217","9.2.9.v20150224"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"fixed":"9.3.27.v20190418"}]}],"versions":["9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.3.v20150827","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"fixed":"9.4.17.v20190418"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.2.v20170220","9.4.2.v20180619","9.4.3.v20170317","9.4.3.v20180619","9.4.4.v20170414","9.4.4.v20180619","9.4.5.v20170502","9.4.5.v20180619","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"netapp","product":"element"},{"vendor":"netapp","product":"oncommand_system_manager"},{"vendor":"netapp","product":"snap_creator_framework"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"netapp","product":"storage_replication_adapter_for_clustered_data_ontap"},{"vendor":"netapp","product":"storage_services_connector"},{"vendor":"netapp","product":"vasa_provider_for_clustered_data_ontap"},{"vendor":"netapp","product":"virtual_storage_console"},{"vendor":"oracle","product":"autovue"},{"vendor":"oracle","product":"communications_analytics"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_services_gatekeeper"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"data_integrator"},{"vendor":"oracle","product":"endeca_information_discovery_integrator"},{"vendor":"oracle","product":"enterprise_manager_base_platform"},{"vendor":"oracle","product":"flexcube_core_banking"},{"vendor":"oracle","product":"flexcube_private_banking"},{"vendor":"oracle","product":"hospitality_guest_access"},{"vendor":"oracle","product":"rest_data_services"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"unified_directory"},{"vendor":"the eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190509-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10246","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r28m-g6j9-r2h5"},{"url":"https://security.netapp.com/advisory/ntap-20190509-0003","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-10246","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","status":"published","published":"2019-04-22T20:14:49Z","modified":"2024-08-04T22:17:19.655Z","cwes":["CWE-213"],"updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-0430","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","status":"published","published":"2019-04-22T20:14:49Z","modified":"2024-08-04T22:17:19Z","updated_at":"2026-11-03T02:40:53.61807Z"}],"ghsa":[{"id":"GHSA-r28m-g6j9-r2h5","title":"Information Exposure vulnerability in Eclipse Jetty","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","status":"published","published":"2019-04-23T16:07:18Z","modified":"2023-02-01T05:01:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-213"],"updated_at":"2026-11-02T14:36:30.61364Z"}],"nvd":[{"id":"CVE-2019-10246","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","status":"published","published":"2019-04-22T20:29:00.303Z","modified":"2026-06-17T02:10:34.107Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-213","CWE-200"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-10246","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","status":"published","published":"2019-04-22T20:29:00.303Z","modified":"2026-10-24T10:30:53.347098444Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-r28m-g6j9-r2h5","title":"Information Exposure vulnerability in Eclipse Jetty","description":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","status":"published","published":"2019-04-23T16:07:18Z","modified":"2024-02-16T08:10:20.837486Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-213"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}