Eclipse Jetty XSS Vulnerability in jetty9 Package - CVE-2019-10241
Summary
CVE-2019-10241: In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandle... Affects jetty9 across 128 version ranges.
< 0af30bce5aebb447f9e235b1634e8104490c1426
< 0bab7e661605babf4b4557a6ec4f9fda5eed86da
< 0bb16b5bf079a7831cf100e720c7deadf222649b
< 0bbebec1e0981eaca2d2110f8322e4a953b1b066
< 0f3b1cbe368f6d5aca01f3a3efc95ac41fff6035
< 1cc075cf9826f5128dd0c6561ba16c4d7c95c281
< 1f3b3f31f468aa4f6dfaf224ef6542ef6d99fd30
< 1f8159b1e4a42d3f79997021ea1609f2fbac6de5
< 1f9703cf836af6c70ac0665fbc6790c0a8229a7a
< 3b1533673ef0c22b876a60e4e827162b73371499
< 3ce520221d0240229c862b122d2b06c12a625732
< 3da7b4794b946f8351f7f1b876a5acbdad0cac63
< 3dc8f557c6fa8a442ba25a33e087c394575eb1a4
< 4a674b9cc96de3e28d4fddf9abb8e7d1a456db96
< 4aaa576b2f231bd487ca715dcb3f87eb94abc286
< 5c2821fdeed309fade59c3f6895fd38b91eea962
< 06b494eeac0a5ba3cf236084caa93c14103071e3
< 6c8af2b895021de087bcb65e756a34b168221ca3
< 7b94bc32f4b5cbeb1d12ef25de7750503b2878eb
< 7dd84279d13352a2f2e4fb87cc42da79a0646fe3
< 8b35fdc5a5d9870bab05bb11ac9f4a3f2977a153
< 8ba0f2d95dbacbe34898f8de15389e39b4e44279
< 8c58a9abc4bfae272a3dfc2a7e2587134ce3abd4
< 8c637489ae2bdc2d281b8db171e7427a47fdcc2b
< 9.4.18-2
< 9b6890d3c1b5b666ed8bc5743df49fd0a13b7a3c
< 9bfeb2221f4fde3a32c042486df06bb09d7bd672
< 9d8ad7489c2dc546e6cfe74c801d17f638430d1d
< 9d648f40001f165472d863b89bb68313fbf67208
< 9fd6d4354e7a6d5ea0b0a8fff47351ba37b9babd
< 15bd75f858955ce088b3f4971527e6c828a19f16
< 16c435c69d2bbfa16579556a396b1ac48ef3bd84
< 18acd5e78e1325485299fa6e2e2ac834df8424b0
< 19a3ca399d55cfbbdb3d8b5aad5aa164d6956c4f
< 21ca3f6690bff813c546a1da4bb7950c3f91a814
< 26b7597928025169b53b52e1880ec49f9b34c45f
< 28b0688e030a7a0e8beda866bf5da940393835c5
< 028f4b9610f12368d418cf0955a1882f4a96c7ec
< 56c4cd2d3052891b847a73f19a7b372cf8d63699
< 63a014dc6af2179947dbfa77a65b51112e0092f0
< 71ad2114c5e40c7cc4b81c4f9e42e3e3acf49efc
< 71e0f4d8ce1e6e78ce6de6429e994dcd60027ba7
< 80fb788d0c152c0628e1292f9d571baee720e336
< 82b8fb23f757335bb3329d540ce37a2a2615f0a8
< 95e94b49d861b1b3af8571945392d6a96688d8c1
< 096fb58088d87dbce957a822d1dd76b570fd4bbb
< 97d2bd95a6dd5fdbc64910c757140fbeab2afa62
< 224f63adf3cb5709e0c4ce97e87cb6d2d080cf06
< 307d23975eb37d690890464668dc8101be5ff9d2
< 362e7665957eb1fa8dee3df7da79848fa03a691a
< 372c0c566fec8a38524f01ac8f463610aaa14936
< 390a593fe0fb5cae5ddd2626dc5643b9bdb43336
< 390f3200cce7f90f1f3ebc78013c1afea2f93db8
< 0484a0b3ec71d06f2ee29161bd000a9669dca4fd
< 513b5e5f900e302e363b0cebfd809dfca8884d50
< 0554f8d8b4c884de6e35a9f7a5481b78e2f34b4f
< 556ecbcdcf4bdb61c8ca33c5fb009a2747a519c7
< 680ecd646b8bf2ece4df4022a56e62886fd090de
< 772ff0bfd4a82a08219dab0757a1ca14e6549629
< 778fac638d7e4c890c58167dbbe43a98fcdcec4d
< 798fc8118b4eec94bb96122b4242233dae9b5e5a
< 855ba82071e0ce64d9b38cc610edfd38ed332cb3
< 913c63e597a0376590c4fc344aefe7e19514737c
< 3086adc9654a79a0b905608c4669e8b3b3d2a86f
< 4515fe661b88727fef7f880ad58c2988dce3cd35
< 4830fd15e94492b3ac4eb5ed772d7746a92d2a49
< 14611d2f76be9ebd955bff6cdd38fde4a008a4c3
< 29722bd8803e76bbdbf70266cb9399560c10b712
< 37296bec3c97e19ca0545b73900078f511f8ea9e
< 49123a3313e396028d0041f631b7243485755f63
< 59681c6885d91642ff3db6c5fe6b51415facd9f7
< 63273aa40b52c1e4d93217df87f72f1139d4ff36
< 84205aa28f11a4f31f2a3b86d1bba2cc8ab69827
< 299458fe51e7127429720e8a7ebf8f2bb421ecf6
< 705048cc4958ef50aca5070c275d3594db9ab700
< 47868688ddfd30109ce0edda0961fe739c23f1d9
< 27208684755d94a92186989f695db2d7b21ebc51
< 461053716206b61d5a0513bc66b606e742f3cfad
< 4573761367104e6c79456dbb4affc7c129d8d0f7
< a6178426956b56b24f1fdeb496a40553d2582b64
< b35d32f2b89e686ab55bd73e5a7fd37058303d43
< b91cc8a4ea8c9deb6a8c0e038a2a4a1f8b9c85be
< b6573c751d79b2711cc12500c921f644997006b3
< b935082f5919df32c5fd0a6df11ab2e3e0623900
< bb1d69ca5204dd1ce822d6a6b292dd309352e0b4
< bb4f3c4882a3f4f8a4e9a4446890cfebe756e2d0
< bc673eab1a2d21e568cde2cf786ee062529ab3d2
< bcbcee7f237c115db55bc8ec49b4491a84104c92
< bd7a8eddbca0a70f8c9a98bb128794a865b1e42e
< bee564c7d942447f02e8d87a2ea5fe30e651a59c
< bf9d17540c7ae4c91be30c045a9485aa2030d3e5
< c0b191119b74afafb6b59ecaa9d7a66dae056498
< c3a78e70a8745fcc1d83bee46cca89e03267632a
< c6e5bdf8b4b979891c685c37a09ae00f42d06ec2
< c8e6256c3d312763aee56fb3e33340f028052964
< c54efb59293b96a6e6525a8d2e108f84b6ba75d0
< c78b7c6d97ab58fcd618f7b1706b2ec1e0cf1989
< c86f06646a024c995b0101022c7dc5818f64b23f
< c177d649f43e1c7eb50d22ed6171c817ec18051e
< c9493e74cb4f10f4abbc9018a634e005155d6d6e
< c4550056e785fb5665914545889f21dc136ad9e6
< cae7e6543057a603e021dfff8453ecae95816130
< cdbe7336840cf47c2dc45d3b0285cb81674ff39d
< d2a16ed2dc3ff1bc64e72610dd9876d9831594ba
< d2dbe18cfbb36b6df142bb94c0c80396571084fc
< d3dec8d51310670d44fcf5b125644fd9d3924707
< d3ff3423f0c2ac6484008ee30509853e509d6734
< d5fc0523cfa96bfebfbda19606cad384d772f04c
< d36d57d5c7d3a9ee19e4f75e04465a68fa26eccd
< d737e1c638653988ce7d8e5bfb89859347e1c306
< da11e86bccbcbd65a72012543c114a0af8a86d6f
< daa59876e6f384329b122929e70a80934569428c
< dac1d17a2d2146cf36a73efd1d9c21202680de58
< dc0c3f4c5277d48f29cd6aa8e3c2c9f10ff11b27
< dc62cb5ac7d6f6953b88dc429ee8172ef02388c0
< df03355d00e736b080422d2304dd5bcc73f7db78
< df1ed4fb03154f6a7b002bd95086c3def1bfec65
< df9fdbebcd0521bcf2d860bf258a811f8a5c9dce
< e8af5883c6e958c58b8443314def48e932d73215
< e9edf4c24b038794c045e8e5f275869db6f04e94
< e38e6b5a7f68e8bcce6ebae4e3b5e1576782854a
< e92fd438fda5ee7dd62d84b112dc4a6e75d38645
< e81912f98c9af8927fdc0505df7011c1e368112a
< eb70b240169fcf1abbd86af36482d1c49826fa0b
< ecba378f5c3603fecf677fb47aeb88a0a7b20935
< edc7646a4c80235b9b12f496a42f880aa957d3a7
< eec01cbff415ba12c7bdce20d021c2c1d27843a6
< fdae77842c571a2b9437d1c2b281e0421861fac9
Fixed in 9.4.18-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely used open-source project that provides a Java-based HTTP server and servlet container. It is known for its scalability and performance, making it a popular choice for web applications. The jetty9 package specifically refers to the version 9.x of Jetty, which includes various features for handling web requests and serving resources. However, certain configurations in older versions of jetty9 have been found to be vulnerable to cross-site scripting (XSS) attacks, particularly when a remote client uses specially formatted URLs against the DefaultServlet or ResourceHandler.
Vulnerability Detail
The vulnerability identified as CVE-2019-10241 affects Eclipse Jetty versions 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. It arises from improper handling of specially formatted URLs, which can lead to XSS conditions. An attacker could exploit this vulnerability by crafting a malicious URL that, when accessed by a user, executes arbitrary JavaScript in the context of the user's browser. This could result in unauthorized actions being performed on behalf of the user or sensitive information being disclosed. The vulnerability is classified with a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
9.4.18-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization on URLs processed by the DefaultServlet or ResourceHandler. This can help mitigate the risk of XSS attacks. Additionally, restricting access to these servlets to trusted clients can reduce exposure to potential attacks.
Conclusion
CVE-2019-10241 represents a significant security risk for applications using vulnerable versions of the jetty9 package. It is crucial for developers and system administrators to upgrade to the latest version to mitigate the risk of XSS attacks. Additionally, implementing workarounds can provide temporary relief until an upgrade is possible.
See every vulnerability recorded for jetty9 →
FAQ
CVE-2019-10241 is a vulnerability in Eclipse Jetty that allows for cross-site scripting (XSS) attacks through specially crafted URLs.
The affected versions include jetty9 versions 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade, implement input validation and sanitization on URLs and restrict access to the affected servlets.
The CVSS score for CVE-2019-10241 is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
