jetty-servlet-9.4.9.v20180320.jar: 2 vulnerabilities (highest severity is: 6.1)

[mend-bolt-for-github]

Vulnerable Library - jetty-servlet-9.4.9.v20180320.jar

Jetty Servlet Container

Library home page: https://webtide.com

Path to vulnerable library: /lib/jetty-servlet-9.4.9.v20180320.jar

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jetty-servlet version)	Remediation Possible**
CVE-2019-10241	Medium	6.1	jetty-servlet-9.4.9.v20180320.jar	Direct	9.4.16.v20190411	❌
CVE-2018-12536	Medium	5.3	jetty-servlet-9.4.9.v20180320.jar	Direct	9.4.11.v20180605	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-10241

Vulnerable Library - jetty-servlet-9.4.9.v20180320.jar

Jetty Servlet Container

Library home page: https://webtide.com

Path to vulnerable library: /lib/jetty-servlet-9.4.9.v20180320.jar

Dependency Hierarchy:

• ❌ jetty-servlet-9.4.9.v20180320.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Publish Date: 2019-04-22

URL: CVE-2019-10241

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241

Release Date: 2019-04-22

Fix Resolution: 9.4.16.v20190411

Step up your Open Source Security Game with Mend here

CVE-2018-12536

Vulnerable Library - jetty-servlet-9.4.9.v20180320.jar

Jetty Servlet Container

Library home page: https://webtide.com

Path to vulnerable library: /lib/jetty-servlet-9.4.9.v20180320.jar

Dependency Hierarchy:

• ❌ jetty-servlet-9.4.9.v20180320.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

Publish Date: 2018-06-27

URL: CVE-2018-12536

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-06-27

Fix Resolution: 9.4.11.v20180605

Step up your Open Source Security Game with Mend here