What’s Vulnerable › Vulnerabilities
CVE-2019-10247
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-04-22 · updated 2026-06-17
- Weakness: CWE-213
Description
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
Affected products
- Debian Linux: 9.0, 10.0
- The Eclipse Foundation Eclipse Jetty: 7.0.0-20091005, 7.0.0-maintenance_0, 7.0.0-maintenance_1, 7.0.0-maintenance_2, 7.0.0-maintenance_3, 7.0.0-maintenance_4 (+281)
- NetApp Element: all versions
- OnCommand System Manager 9.x: from 3.0 through 3.1.3
- NetApp Snap Creator Framework: all versions
- NetApp SnapCenter: all versions
- SnapManager for Oracle: all versions
- NetApp Storage Replication Adapter For Clustered Data Ontap: from 9.6
- NetApp Storage Services Connector: all versions
- NetApp Vasa Provider For Clustered Data Ontap: from 9.6
- NetApp Virtual Storage Console: from 9.6
- Oracle Corporation AutoVue 3D Professional Advanced: 21.0.2
- Oracle Communications Analytics: 12.1.1
- Oracle Communications Element Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Services Gatekeeper: 6.0, 6.1, 7.0
- Oracle Communications Session Report Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Session Route Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Corporation Oracle Data Integrator: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Endeca Information Discovery Integrator: 3.2.0
- Oracle Corporation Enterprise Manager Base Platform: 13.2, 13.3
- Oracle FLEXCUBE Core Banking: from 11.5.0 through 11.7.0; 5.2.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Fmw Platform: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0
- Oracle Corporation Oracle Unified Directory: 12.2.1.3.0, 12.2.1.4.0
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
- https://security.netapp.com/advisory/ntap-20190509-0003/
- https://www.debian.org/security/2021/dsa-4949
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
Get alerted when CVE-2019-10247 or the next vulnerability affects your stack