https://bugzilla.redhat.com/show_bug.cgi?id=1705924
Bug ID: 1705924
Summary: CVE-2019-10241 jetty: using specially formatted URL
against DefaultServlet or ResourceHandler leads to XSS
conditions
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190422,reported=20190423,sour
ce=cve,cvss3=4.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/
I:L/A:N,cwe=CWE-79,fedora-all/jetty=affected,rhel-6/je
tty-eclipse=new,rhel-7/jetty=new,fuse-6/jetty=new,fuse
-7/jetty=new,rhn_satellite_5/jetty=new,rhscl-3/rh-java
-common-jetty=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: aileenc(a)redhat.com, bkearney(a)redhat.com,
chazlett(a)redhat.com, decathorpe(a)gmail.com,
eclipse-sig(a)lists.fedoraproject.org,
ggainey(a)redhat.com, hhorak(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jochrist(a)redhat.com,
jorton(a)redhat.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
tlestach(a)redhat.com
Target Milestone: ---
Classification: Other
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and
older, the server is vulnerable to XSS conditions if a remote client USES a
specially formatted URL against the DefaultServlet or ResourceHandler that is
configured for showing a Listing of directory contents.
External References:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121
--
You are receiving this mail because:
You are on the CC list for the bug.