What is the CVSS score of CVE-2019-10247?

CVE-2019-10247 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 5.8%.

Is there a patch available for CVE-2019-10247?

Yes, a patch is available for CVE-2019-10247. Update the affected software to the latest version immediately.

Jetty CVE-2019-10247

MEDIUM

Exposure of Sensitive Information Due to Incompatible Policies (CWE-213)

2019-04-22 emo@eclipse.org

Information Disclosure Jetty Oncommand System Manager Snap Creator Framework Snapcenter Snapmanager Storage Replication Adapter For Clustered Data Ontap Storage Services Connector Vasa Provider For Clustered Data Ontap Virtual Storage Console Element Autovue Communications Analytics Communications Element Manager Communications Services Gatekeeper Communications Session Report Manager Communications Session Route Manager Data Integrator Endeca Information Discovery Integrator Enterprise Manager Base Platform Flexcube Core Banking Flexcube Private Banking Fmw Platform Hospitality Guest Access Retail Xstore Point Of Service Unified Directory Debian Linux

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 22, 2019 - 20:29 nvd

MEDIUM 5.3

DescriptionNVD

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

AnalysisAI

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-213. In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. Affected products include: Eclipse Jetty, Netapp Oncommand System Manager, Netapp Snap Creator Framework, Netapp Snapcenter, Netapp Snapmanager. Version information: version 7..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.