In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote cl

Summary

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Timeline

1. Apr 22, 2019, 8:14 PM UTCCVE published
2. Aug 4, 2024, 10:17 PM UTCRecord last updated

Affected versions

• The Eclipse Foundation Eclipse Jetty

  through 9.2.26; through 9.3.25; through 9.4.15

• org.eclipse.jetty:jetty-serverMaven

  fixed in 9.2.27.v20190403

• org.eclipse.jetty:jetty-serverMaven

  From 9.3.0 · fixed in 9.3.26.v20190403

• org.eclipse.jetty:jetty-serverMaven

  From 9.4.0 · fixed in 9.4.16.v20190411

References 15