This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-10241 →

DEBIAN-CVE-2019-10241

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES...

Original description

The description as published by the source.

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.18-2"}]}]

Debian:13 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.18-2"}]}]

Debian:14 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.18-2"}]}]

References

advisory security-tracker.debian.org