File Path Disclosure Vulnerability in Eclipse Jetty Server

CVE-2018-12536

What is CVE-2018-12536?

A file path disclosure vulnerability exists in the Eclipse Jetty Server across all 9.x versions due to improper error handling of bad queries. When a malformed request that does not conform to a dynamic URL pattern is processed by the DefaultServlet, it may trigger a java.nio.file.InvalidPathException. If the default error handler processes this exception, the complete server path is disclosed in the error response, exposing sensitive information about the server's structure to potential attackers.

References