CVE-2019-10246

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Published: 2019-04-22 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2019-10246 is rated Moderate Risk (51/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.62%). Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2019-10246

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-02-05 2.67% 2.62% -0.05%
2 2025-12-28 2.26% 2.67% +0.41%
3 2025-12-27 2.26%

Full EPSS history (28 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2019-10246

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
3.9 1.4 [email protected]
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
10.0 2.9 [email protected]

Weakness enumeration for CVE-2019-10246

GitHub Security Advisory for CVE-2019-10246

GHSA-r28m-g6j9-r2h5 · Severity: medium · Ecosystem: maven — Information Exposure vulnerability in Eclipse Jetty

OS Trackers for CVE-2019-10246

vendor priority summary link
debian unimportant CVE-2019-10246 unimportant priority: Debian including 1 source packages (jetty9), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2019-10246
redhat low https://access.redhat.com/security/cve/CVE-2019-10246
ubuntu medium CVE-2019-10246 medium priority: Ubuntu including 3 source packages (jetty, jetty8, jetty9), 18 status rows across 6 suites (bionic, cosmic, disco, trusty, upstream, xenial): not-affected 8, DNE 7, needs-triage 3. https://ubuntu.com/security/CVE-2019-10246

Affected software / configurations for CVE-2019-10246

Vendor Product Version Raw CPE
eclipse jetty 9.2.27 cpe:2.3:a:eclipse:jetty:9.2.27:20190403:*:*:*:*:*:*
eclipse jetty 9.3.26 cpe:2.3:a:eclipse:jetty:9.3.26:20190403:*:*:*:*:*:*
eclipse jetty 9.4.16 cpe:2.3:a:eclipse:jetty:9.4.16:20190411:*:*:*:*:*:*
netapp oncommand_system_manager >= 3.0, <= 3.1.3 cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
netapp snap_creator_framework cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
netapp snapcenter cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
netapp snapmanager cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*
netapp snapmanager cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:*
netapp storage_replication_adapter_for_clustered_data_ontap >= 9.6 cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*
netapp storage_replication_adapter_for_clustered_data_ontap 9.6 cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:*:*:*
netapp storage_services_connector cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:*
netapp vasa_provider_for_clustered_data_ontap >= 9.6 cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*
netapp vasa_provider_for_clustered_data_ontap cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:-:*:*:*:*:*:*:*
netapp virtual_storage_console >= 9.6 cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*
netapp virtual_storage_console 9.6 cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:*:*:*
netapp element cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:*
oracle autovue 21.0.2 cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*
oracle communications_analytics 12.1.1 cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*
oracle communications_element_manager 8.0.0 cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*
oracle communications_element_manager 8.1.0 cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*
oracle communications_element_manager 8.1.1 cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*
oracle communications_element_manager 8.2.0 cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*
oracle communications_services_gatekeeper 6.0 cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*
oracle communications_services_gatekeeper 6.1 cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*
oracle communications_services_gatekeeper 7.0 cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.0.0 cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.1.0 cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.1.1 cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*
oracle communications_session_report_manager 8.2.0 cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.0.0 cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.1.0 cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.1.1 cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*
oracle communications_session_route_manager 8.2.0 cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*
oracle data_integrator 12.2.1.3.0 cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
oracle data_integrator 12.2.1.4.0 cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
oracle endeca_information_discovery_integrator 3.2.0 cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
oracle enterprise_manager_base_platform 13.2 cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*
oracle enterprise_manager_base_platform 13.3 cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*
oracle flexcube_core_banking >= 11.5.0, <= 11.7.0 cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*
oracle flexcube_core_banking 5.2.0 cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*
oracle flexcube_private_banking 12.0.0 cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
oracle flexcube_private_banking 12.1.0 cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
oracle hospitality_guest_access 4.2.0 cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
oracle hospitality_guest_access 4.2.1 cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
oracle rest_data_services 11.2.0.4 cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*
oracle rest_data_services 12.1.0.2 cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*
oracle rest_data_services 12.2.0.1 cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*
oracle rest_data_services 18c cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*
oracle retail_xstore_point_of_service 7.1 cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 15.0 cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 16.0 cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 17.0 cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
oracle unified_directory 12.2.1.3.0 cpe:2.3:a:oracle:unified_directory:12.2.1.3.0:*:*:*:*:*:*:*
oracle unified_directory 12.2.1.4.0 cpe:2.3:a:oracle:unified_directory:12.2.1.4.0:*:*:*:*:*:*:*

References for CVE-2019-10246

URL Tags
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576 Issue Tracking Vendor Advisory
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
https://security.netapp.com/advisory/ntap-20190509-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Third Party Advisory
cvelogic Threat Intelligence