{"id":"CVE-2019-10246","details":"In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.","aliases":["GHSA-r28m-g6j9-r2h5"],"modified":"2026-08-27T03:47:57.692139280Z","published":"2019-04-22T20:29:00.303Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0"},{"last_affected":"3.1.3"}],"source":"CPE_RANGE","vendor_product":"netapp:oncommand_system_manager"},{"extracted_events":[{"introduced":"9.6"}],"source":"CPE_RANGE","vendor_product":"netapp:storage_replication_adapter_for_clustered_data_ontap","cpes":["cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*"]},{"source":"CPE_RANGE","vendor_product":"netapp:vasa_provider_for_clustered_data_ontap","cpes":["cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.6"}]},{"cpes":["cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*"],"extracted_events":[{"introduced":"9.6"}],"source":"CPE_RANGE","vendor_product":"netapp:virtual_storage_console"},{"extracted_events":[{"introduced":"11.5.0"},{"last_affected":"11.7.0"}],"source":"CPE_RANGE","vendor_product":"oracle:flexcube_core_banking","cpes":["cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*"]},{"vendor_product":"netapp:storage_replication_adapter_for_clustered_data_ontap","cpes":["cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.6"},{"last_affected":"9.6"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"9.6"},{"last_affected":"9.6"}],"source":"CPE_STRING","vendor_product":"netapp:virtual_storage_console","cpes":["cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:autovue","cpes":["cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"21.0.2"},{"last_affected":"21.0.2"}]},{"vendor_product":"oracle:communications_analytics","cpes":["cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.1"},{"last_affected":"12.1.1"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.1.0"},{"last_affected":"8.1.0"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_element_manager","cpes":["cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*"]},{"vendor_product":"oracle:communications_services_gatekeeper","cpes":["cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"6.1"},{"last_affected":"6.1"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING"},{"vendor_product":"oracle:communications_session_report_manager","cpes":["cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.1.0"},{"last_affected":"8.1.0"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.1.0"},{"last_affected":"8.1.0"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_session_route_manager","cpes":["cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}],"source":"CPE_STRING","vendor_product":"oracle:data_integrator","cpes":["cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:endeca_information_discovery_integrator","cpes":["cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.2.0"},{"last_affected":"3.2.0"}]},{"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_base_platform","cpes":["cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.2"},{"last_affected":"13.2"},{"introduced":"13.3"},{"last_affected":"13.3"}]},{"extracted_events":[{"introduced":"5.2.0"},{"last_affected":"5.2.0"}],"source":"CPE_STRING","vendor_product":"oracle:flexcube_core_banking","cpes":["cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.0.0"},{"last_affected":"12.0.0"},{"introduced":"12.1.0"},{"last_affected":"12.1.0"}],"source":"CPE_STRING","vendor_product":"oracle:flexcube_private_banking"},{"source":"CPE_STRING","vendor_product":"oracle:hospitality_guest_access","cpes":["cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.2.0"},{"last_affected":"4.2.0"},{"introduced":"4.2.1"},{"last_affected":"4.2.1"}]},{"source":"CPE_STRING","vendor_product":"oracle:rest_data_services","cpes":["cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*","cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*","cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*","cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*"],"extracted_events":[{"introduced":"11.2.0.4"},{"last_affected":"11.2.0.4"},{"introduced":"12.1.0.2"},{"last_affected":"12.1.0.2"},{"introduced":"12.2.0.1"},{"last_affected":"12.2.0.1"},{"introduced":"18c"},{"last_affected":"18c"}]},{"vendor_product":"oracle:retail_xstore_point_of_service","cpes":["cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.1"},{"last_affected":"7.1"},{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"},{"introduced":"17.0"},{"last_affected":"17.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}],"source":"CPE_STRING","vendor_product":"oracle:unified_directory"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20190509-0003/"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujul2020.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"ADVISORY","url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"},{"type":"REPORT","url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jetty/jetty.project","events":[{"introduced":"84dfe74b974291cfdba6c855c89d65049bed739e"},{"last_affected":"e0aa4ae4c0fe2e6bb3ecde2eb3e54bc3087b2f52"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.2.27-20190403"},{"last_affected":"9.2.27-20190403"},{"introduced":"9.3.26-20190403"},{"last_affected":"9.3.26-20190403"},{"introduced":"9.4.16-20190411"},{"last_affected":"9.4.16-20190411"}]}}],"versions":["9.2.27-20190403","9.3.26-20190403","9.4.16-20190411"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10246.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}