5.3

CVE-2019-10246

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Data is provided by the National Vulnerability Database (NVD)
Eclipse ≫ Jetty Version9.2.27 Update20190403
   Microsoft ≫ Windows Version-
Eclipse ≫ Jetty Version9.3.26 Update20190403
   Microsoft ≫ Windows Version-
Eclipse ≫ Jetty Version9.4.16 Update20190411
   Microsoft ≫ Windows Version-
Netapp ≫ Oncommand System Manager Version >= 3.0 <= 3.1.3
Netapp ≫ Snapcenter Version-
Netapp ≫ Snapmanager Version- Update- SwPlatformoracle
Netapp ≫ Snapmanager Version- Update- SwPlatformsap
Netapp ≫ Storage Replication Adapter For Clustered Data Ontap SwPlatformvmware_vsphere Version >= 9.6
Netapp ≫ Virtual Storage Console SwPlatformvmware_vsphere Version >= 9.6
Netapp ≫ Element Version- SwPlatformvcenter_server
Oracle ≫ Autovue Version21.0.2
Oracle ≫ Communications Analytics Version12.1.1
Oracle ≫ Data Integrator Version12.2.1.3.0
Oracle ≫ Data Integrator Version12.2.1.4.0
Oracle ≫ Flexcube Core Banking Version >= 11.5.0 <= 11.7.0
Oracle ≫ Flexcube Core Banking Version5.2.0
Oracle ≫ Flexcube Private Banking Version12.0.0
Oracle ≫ Flexcube Private Banking Version12.1.0
Oracle ≫ Hospitality Guest Access Version4.2.0
Oracle ≫ Hospitality Guest Access Version4.2.1
Oracle ≫ Rest Data Services Version11.2.0.4 SwEdition-
Oracle ≫ Rest Data Services Version12.1.0.2 SwEdition-
Oracle ≫ Rest Data Services Version12.2.0.1 SwEdition-
Oracle ≫ Rest Data Services Version18c SwEdition-
Oracle ≫ Unified Directory Version12.2.1.3.0
Oracle ≫ Unified Directory Version12.2.1.4.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.7% 0.817
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-213 Exposure of Sensitive Information Due to Incompatible Policies

The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.