Home

CVE-2019-10241

Description

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Risk Information

Base Score
6.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
Exploitation Probability
9.686

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2019-10241 are fixed in Eclipse-jetty-server 9.2.27Windows
Vulnerabilities CVE-2019-10241 are fixed in Eclipse-jetty-server 9.3.26Windows
Vulnerabilities CVE-2019-10241 are fixed in Eclipse-jetty-server 9.4.16Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.3Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.1Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2.6.5Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.11.0.1Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.11.1Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.10.4Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.10.5.2Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.12.0.1Windows
jetty9 security update(DSA-4949-1) jetty9_9.4.16-0+deb10u1_all.debLinux
Vulnerabilities CVE-2019-10241 are fixed in Eclipse-jetty-server for Linux 9.2.27Linux
Vulnerabilities CVE-2019-10241 are fixed in Eclipse-jetty-server for Linux 9.3.26Linux
Vulnerabilities CVE-2019-10241 are fixed in Eclipse-jetty-server for Linux 9.4.16Linux
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability (CVE-2019-10241)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234