In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES...
Original description
The description as published by the source.
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-10241 jetty9 Fixed in: 9.4.18-2
References
- advisory lists.debian.org
- advisory security.netapp.com
- advisory debian.org
- patch oracle.com
- patch oracle.com
- report bugs.eclipse.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org