CVE-2019-10241 Cross-site Scripting in Eclipse Jetty
Remote attackers can execute arbitrary scripts via specially formatted URLs when directory listing is enabled in Eclipse Jetty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10241?
CVE-2019-10241 is a medium-severity cross-site scripting vulnerability in Apache Activemq, published on 22 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Weakness: CWE-79
Which versions are affected by CVE-2019-10241?
6 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | All versions | 9.2.27.v20190403 |
org.eclipse.jetty:jetty-server Maven | All versions | 9.2.27.v20190403 |
org.eclipse.jetty:jetty-server Maven | From 9.3.0 | 9.3.26.v20190403 |
org.eclipse.jetty:jetty-server Maven | From 9.3.0 | 9.3.26.v20190403 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.16.v20190411 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.16.v20190411 |
Products include Apache Activemq, Apache Drill, Debian Debian Linux, Eclipse Jetty, Oracle Flexcube Core Banking, Oracle Rest Data Services and 1 more.
How do I fix CVE-2019-10241?
Upgrade org.eclipse.jetty:jetty-server to a fixed version for your release line: 9.2.27.v20190403, 9.3.26.v20190403 or 9.4.16.v20190411.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-10241 being exploited?
There is no known exploitation of CVE-2019-10241 in the wild and no public exploit code.
Other vulnerabilities in Apache Activemq
Sources
Also known as CLEANSTART-2026-AD64565, DEBIAN-CVE-2019-10241, GHSA-7vx9-xjhr-rw6h, OESA-2022-2140, OESA-2022-2148, OESA-2022-2149 and 1 more.