CVE-2019-10246

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16

Description The issue is related to the exposure of the fully qualified Base Resource directory name on Windows to a remote client when the server is configured to show a listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Recommendations For Eclipse Jetty version 9.2.27, consider disabling the directory listing feature to prevent exposure of sensitive information. For Eclipse Jetty version 9.3.26, restrict access to the base resource directories to minimize the risk of exploitation. For Eclipse Jetty version 9.4.16, avoid configuring the server to show directory contents until a fix is available.