CVE-2019-10246: Information Exposure vulnerability in Eclipse Jetty
Summary
CVE-2019-10246: Information Exposure vulnerability in Eclipse Jetty. Affects org.eclipse.jetty:jetty-server across 3 version ranges.
>= 9.2.0, < 9.2.28.v20190418
>= 9.3.0, < 9.3.27.v20190418
>= 9.4.0, < 9.4.17.v20190418
Fixed in 9.2.28.v20190418, 9.3.27.v20190418 or 9.4.17.v20190418, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a Java-based web server and servlet container. It is widely used in various applications to provide HTTP server capabilities. The Jetty server is known for its lightweight and high-performance nature. It supports multiple versions of the HTTP protocol and provides various features for web application development. However, versions 9.2.27, 9.3.26, and 9.4.16 of Jetty are vulnerable to an information exposure issue on Windows systems when configured to show a listing of directory contents. This vulnerability can potentially expose the fully qualified Base Resource directory name to a remote client, revealing sensitive information about the server's file system structure.
Vulnerability Detail
The vulnerability in Eclipse Jetty allows a remote client to obtain the fully qualified Base Resource directory name on Windows systems when the server is configured to show a listing of directory contents. This information disclosure is limited to the content within the configured base resource directories. An attacker could exploit this vulnerability to gain insights into the server's file system structure, potentially aiding in further attacks or unauthorized access. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.2.0, < 9.2.28.v201904189.2.28.v20190418 -
>= 9.3.0, < 9.3.27.v201904189.3.27.v20190418 -
>= 9.4.0, < 9.4.17.v201904189.4.17.v20190418
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the directory listing feature in the Jetty server configuration. By disabling the directory listing, the vulnerability can be mitigated. Here is an example of how to disable directory listing in Jetty's configuration file:
<Configure class="org.eclipse.jetty.server.Server">
<Call name="setAttribute">
<Arg>org.eclipse.jetty.server.Request.maxFormContentSize</Arg>
<Arg>0</Arg>
Conclusion
In conclusion, Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16 are vulnerable to an information exposure issue on Windows systems. This vulnerability allows a remote client to obtain the fully qualified Base Resource directory name, potentially revealing sensitive information about the server's file system structure. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions of Jetty or apply the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
Eclipse Jetty is a Java-based web server and servlet container known for its lightweight and high-performance nature. It is widely used in various applications to provide HTTP server capabilities.
Versions 9.2.27, 9.3.26, and 9.4.16 of Jetty are affected by this information exposure vulnerability.
This vulnerability allows a remote client to obtain the fully qualified Base Resource directory name on Windows systems, potentially revealing sensitive information about the server's file system structure.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Jetty: 9.2.28.v20190418 or later, 9.3.27.v20190418 or later, or 9.4.17.v20190418 or later.
Yes, a temporary workaround is to disable the directory listing feature in the Jetty server configuration. This can be achieved by modifying the configuration file as mentioned in the 'workaround' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
