CVE-2019-10247

5.3 mediumEPSS 5.9%

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 5.9% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-213
Published: 2019-04-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
eclipse:jetty
netapp:element
netapp:oncommand_system_manager
netapp:snap_creator_framework
netapp:snapcenter
netapp:snapmanager
netapp:storage_replication_adapter_for_clustered_data_ontap
netapp:storage_services_connector
netapp:vasa_provider_for_clustered_data_ontap
netapp:virtual_storage_console
oracle:autovue
oracle:communications_analytics
oracle:communications_element_manager
oracle:communications_services_gatekeeper
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:data_integrator
oracle:endeca_information_discovery_integrator
oracle:enterprise_manager_base_platform
oracle:flexcube_core_banking
oracle:flexcube_private_banking
oracle:fmw_platform
oracle:hospitality_guest_access
oracle:retail_xstore_point_of_service
oracle:unified_directory

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-xc67-hjx6-cgg6	Maven	org.eclipse.jetty:jetty-server	>=7.0.0 <9.2.28.v20190418	9.2.28.v20190418
GHSA-xc67-hjx6-cgg6	Maven	org.eclipse.jetty:jetty-server	>=9.3.0 <9.3.27.v20190418	9.3.27.v20190418
GHSA-xc67-hjx6-cgg6	Maven	org.eclipse.jetty:jetty-server	>=9.4.0 <9.4.17.v20190418	9.4.17.v20190418

References

Check your stack JSON