What is the CVSS score of CVE-2019-10247?

CVE-2019-10247 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 5.8%.

Is there a patch available for CVE-2019-10247?

Yes, a patch is available for CVE-2019-10247. Update the affected software to the latest version immediately.

Debian Linux CVE-2019-10247

MEDIUM

Exposure of Sensitive Information Due to Incompatible Policies (CWE-213)

2019-04-22 emo@eclipse.org

Information Disclosure Debian Oracle Debian Linux Jetty Snapmanager Element Snapcenter Communications Services Gatekeeper Oncommand System Manager Snap Creator Framework Vasa Provider For Clustered Data Ontap Virtual Storage Console Hospitality Guest Access Endeca Information Discovery Integrator Fmw Platform Retail Xstore Point Of Service Flexcube Private Banking Communications Element Manager Communications Session Report Manager Communications Session Route Manager Enterprise Manager Base Platform Autovue Data Integrator Flexcube Core Banking Storage Replication Adapter For Clustered Data Ontap Communications Analytics Storage Services Connector Unified Directory Netapp Eclipse

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 22, 2019 - 20:29 nvd

MEDIUM 5.3

DescriptionNVD

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

AnalysisAI

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-213. In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. Affected products include: Eclipse Jetty, Netapp Oncommand System Manager, Netapp Snap Creator Framework, Netapp Snapcenter, Netapp Snapmanager. Version information: version 7..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.