Directory Traversal Vulnerability in Eclipse Jetty by Eclipse Foundation

CVE-2019-10247

What is CVE-2019-10247?

Eclipse Jetty versions 7.x and 8.x, along with certain older versions of 9.x, are susceptible to a directory traversal vulnerability. When a user attempts to access a non-existent context, the server will erroneously disclose the full path of the configured directory base resource location in the output of the 404 error response. This output reveals critical directory structures, potentially allowing malicious actors to map the server's file system and exploit the configuration. This behavior is enabled by the DefaultHandler in the Jetty server, which lists all configured contexts, including sensitive file paths, directly in the HTML response.

References