Medium
Security advisory
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-10246
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:26 UTC · Revision 1
Source evidence
In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
osv:CVE-2019-10246
Complete source record
{
"id": "0af1d20ed0c69e897129625f7a115e7f7acaa3de356d60db15594c5a8dae0ac7",
"url": "https://osv.dev/vulnerability/CVE-2019-10246",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-10246",
"summary": "In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.",
"evidence": "osv:CVE-2019-10246",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-10246",
"aliases": [
"CVE-2019-10246",
"GHSA-r28m-g6j9-r2h5"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jetty/jetty.project",
"type": "GIT",
"events": [
{
"introduced": "84dfe74b974291cfdba6c855c89d65049bed739e"
},
{
"last_affected": "e0aa4ae4c0fe2e6bb3ecde2eb3e54bc3087b2f52"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*",
"range": [
{
"introduced": "9.2.27-20190403"
},
{
"last_affected": "9.2.27-20190403"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.26-20190403"
},
{
"last_affected": "9.3.26-20190403"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*",
"range": [
{
"introduced": "9.4.16-20190411"
},
{
"last_affected": "9.4.16-20190411"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.2.27-20190403",
"9.3.26-20190403",
"9.4.16-20190411"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10246.json"
}
}
],
"modified": "2026-10-24T10:30:53.347098444Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E",
"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://security.netapp.com/advisory/ntap-20190509-0003/",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "netapp:oncommand_system_manager",
"extracted_events": [
{
"range": [
{
"introduced": "3.0"
},
{
"last_affected": "3.1.3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*"
],
"vendor_product": "netapp:storage_replication_adapter_for_clustered_data_ontap",
"extracted_events": [
{
"range": [
{
"introduced": "9.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*"
],
"vendor_product": "netapp:vasa_provider_for_clustered_data_ontap",
"extracted_events": [
{
"range": [
{
"introduced": "9.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*"
],
"vendor_product": "netapp:virtual_storage_console",
"extracted_events": [
{
"range": [
{
"introduced": "9.6"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:flexcube_core_banking",
"extracted_events": [
{
"range": [
{
"introduced": "11.5.0"
},
{
"last_affected": "11.7.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*"
],
"vendor_product": "eclipse:jetty",
"extracted_events": [
{
"range": [
{
"introduced": "9.2.27-20190403"
},
{
"last_affected": "9.2.27-20190403"
},
{
"introduced": "9.3.26-20190403"
},
{
"last_affected": "9.3.26-20190403"
},
{
"introduced": "9.4.16-20190411"
},
{
"last_affected": "9.4.16-20190411"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:*"
],
"vendor_product": "netapp:storage_replication_adapter_for_clustered_data_ontap",
"extracted_events": [
{
"range": [
{
"introduced": "9.6"
},
{
"last_affected": "9.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:*"
],
"vendor_product": "netapp:virtual_storage_console",
"extracted_events": [
{
"range": [
{
"introduced": "9.6"
},
{
"last_affected": "9.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:autovue",
"extracted_events": [
{
"range": [
{
"introduced": "21.0.2"
},
{
"last_affected": "21.0.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_analytics",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.1"
},
{
"last_affected": "12.1.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_element_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.0"
},
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
},
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_services_gatekeeper",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "6.1"
},
{
"last_affected": "6.1"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_report_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.0"
},
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
},
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_route_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.0"
},
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
},
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:data_integrator",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:endeca_information_discovery_integrator",
"extracted_events": [
{
"range": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_manager_base_platform",
"extracted_events": [
{
"range": [
{
"introduced": "13.2"
},
{
"last_affected": "13.2"
},
{
"introduced": "13.3"
},
{
"last_affected": "13.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:flexcube_core_banking",
"extracted_events": [
{
"range": [
{
"introduced": "5.2.0"
},
{
"last_affected": "5.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:flexcube_private_banking",
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0"
},
{
"last_affected": "12.0.0"
},
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:hospitality_guest_access",
"extracted_events": [
{
"range": [
{
"introduced": "4.2.0"
},
{
"last_affected": "4.2.0"
},
{
"introduced": "4.2.1"
},
{
"last_affected": "4.2.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*",
"cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*",
"cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*",
"cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*"
],
"vendor_product": "oracle:rest_data_services",
"extracted_events": [
{
"range": [
{
"introduced": "11.2.0.4"
},
{
"last_affected": "11.2.0.4"
},
{
"introduced": "12.1.0.2"
},
{
"last_affected": "12.1.0.2"
},
{
"introduced": "12.2.0.1"
},
{
"last_affected": "12.2.0.1"
},
{
"introduced": "18c"
},
{
"last_affected": "18c"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_xstore_point_of_service",
"extracted_events": [
{
"range": [
{
"introduced": "7.1"
},
{
"last_affected": "7.1"
},
{
"introduced": "15.0"
},
{
"last_affected": "15.0"
},
{
"introduced": "16.0"
},
{
"last_affected": "16.0"
},
{
"introduced": "17.0"
},
{
"last_affected": "17.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:unified_directory",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-10246",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437900,
"published_at": "2019-04-22T20:29:00.303+00:00"
}