CVE-2019-10247

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-213CWE-200

Affected software

VendorProductVersions
The Eclipse FoundationEclipse Jetty7.x; 8.x; >= unspecified, <= 9.2.27; >= unspecified, <= 9.3.26; >= unspecified, <= 9.4.16

References

Timeline

Published
Apr 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-102488.1Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependentCVE-2019-102498.1All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been cCVE-2019-10256.5A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulneCVE-2019-102505.9UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.CVE-2019-102515.9The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft OffiCVE-2019-102536.5A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (uplCVE-2019-102546.1In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.CVE-2019-102556.1An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.CVE-2019-102569.8An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.CVE-2019-102577.5Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-CVE-2019-10267.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary codeCVE-2019-102606.1Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
CVE-2019-10247: Medium severity, CVSS 5.3 | Vulnix