Description
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | 9.2.27, 9.3.26, 9.4.16 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | >= 9.2.0, < 9.2.28.v20190418 | 9.2.28.v20190418 | GHSA-r28m-g6j9-r2h5 |
| Maven | org.eclipse.jetty:jetty-server | >= 9.3.0, < 9.3.27.v20190418 | 9.3.27.v20190418 | GHSA-r28m-g6j9-r2h5 |
| Maven | org.eclipse.jetty:jetty-server | >= 9.4.0, < 9.4.17.v20190418 | 9.4.17.v20190418 | GHSA-r28m-g6j9-r2h5 |
Advisories 1
- WID-SEC-2023-2946 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 16, 2023
References
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576
- https://security.netapp.com/advisory/ntap-20190509-0003/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html