CVE-2019-10246

5.3 mediumEPSS 4.1%

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-213
Published: 2019-04-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eclipse:jetty
netapp:element
netapp:oncommand_system_manager
netapp:snap_creator_framework
netapp:snapcenter
netapp:snapmanager
netapp:storage_replication_adapter_for_clustered_data_ontap
netapp:storage_services_connector
netapp:vasa_provider_for_clustered_data_ontap
netapp:virtual_storage_console
oracle:autovue
oracle:communications_analytics
oracle:communications_element_manager
oracle:communications_services_gatekeeper
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:data_integrator
oracle:endeca_information_discovery_integrator
oracle:enterprise_manager_base_platform
oracle:flexcube_core_banking
oracle:flexcube_private_banking
oracle:hospitality_guest_access
oracle:rest_data_services
oracle:retail_xstore_point_of_service
oracle:unified_directory

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-r28m-g6j9-r2h5	Maven	org.eclipse.jetty:jetty-server	>=9.2.0 <9.2.28.v20190418	9.2.28.v20190418
GHSA-r28m-g6j9-r2h5	Maven	org.eclipse.jetty:jetty-server	>=9.3.0 <9.3.27.v20190418	9.3.27.v20190418
GHSA-r28m-g6j9-r2h5	Maven	org.eclipse.jetty:jetty-server	>=9.4.0 <9.4.17.v20190418	9.4.17.v20190418

References

Check your stack JSON