5.3
CVE-2019-10247
- EPSS 6.59%
- Published 22.04.2019 20:29:00
- Last modified 21.11.2024 04:18:44
- Source emo@eclipse.org
- Teams watchlist Login
- Open Login
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
Data is provided by the National Vulnerability Database (NVD)
Netapp ≫ Oncommand System Manager Version >= 3.0 <= 3.1.3
Netapp ≫ Snap Creator Framework Version-
Netapp ≫ Snapcenter Version-
Netapp ≫ Snapmanager Version- Update- SwPlatformoracle
Netapp ≫ Snapmanager Version- Update- SwPlatformsap
Netapp ≫ Storage Replication Adapter For Clustered Data Ontap SwPlatformvmware_vsphere Version >= 9.6
Netapp ≫ Storage Services Connector Version-
Netapp ≫ Vasa Provider For Clustered Data Ontap Version >= 9.6
Netapp ≫ Virtual Storage Console SwPlatformvmware_vsphere Version >= 9.6
Oracle ≫ Communications Analytics Version12.1.1
Oracle ≫ Communications Element Manager Version8.0.0
Oracle ≫ Communications Element Manager Version8.1.0
Oracle ≫ Communications Element Manager Version8.1.1
Oracle ≫ Communications Element Manager Version8.2.0
Oracle ≫ Communications Services Gatekeeper Version6.0
Oracle ≫ Communications Services Gatekeeper Version6.1
Oracle ≫ Communications Services Gatekeeper Version7.0
Oracle ≫ Communications Session Report Manager Version8.0.0
Oracle ≫ Communications Session Report Manager Version8.1.0
Oracle ≫ Communications Session Report Manager Version8.1.1
Oracle ≫ Communications Session Report Manager Version8.2.0
Oracle ≫ Communications Session Route Manager Version8.0.0
Oracle ≫ Communications Session Route Manager Version8.1.0
Oracle ≫ Communications Session Route Manager Version8.1.1
Oracle ≫ Communications Session Route Manager Version8.2.0
Oracle ≫ Data Integrator Version12.2.1.3.0
Oracle ≫ Data Integrator Version12.2.1.4.0
Oracle ≫ Endeca Information Discovery Integrator Version3.2.0
Oracle ≫ Enterprise Manager Base Platform Version13.2
Oracle ≫ Enterprise Manager Base Platform Version13.3
Oracle ≫ Flexcube Core Banking Version >= 11.5.0 <= 11.7.0
Oracle ≫ Flexcube Core Banking Version5.2.0
Oracle ≫ Flexcube Private Banking Version12.0.0
Oracle ≫ Flexcube Private Banking Version12.1.0
Oracle ≫ Fmw Platform Version12.2.1.3.0
Oracle ≫ Fmw Platform Version12.2.1.4.0
Oracle ≫ Hospitality Guest Access Version4.2.0
Oracle ≫ Hospitality Guest Access Version4.2.1
Oracle ≫ Retail Xstore Point Of Service Version7.1
Oracle ≫ Retail Xstore Point Of Service Version15.0
Oracle ≫ Retail Xstore Point Of Service Version16.0
Oracle ≫ Retail Xstore Point Of Service Version17.0
Oracle ≫ Unified Directory Version12.2.1.3.0
Oracle ≫ Unified Directory Version12.2.1.4.0
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 6.59% | 0.908 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-213 Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.