Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
eclipse / jetty 9.4.21-20190926 9.4.21-20190926.x
eclipse / jetty 9.4.22-20191022 9.4.22-20191022.x
eclipse / jetty 9.4.23-20191118 9.4.23-20191118.x
org.eclipse.jetty / jetty-server 9.4.21.v20190926 9.4.21.v20190926.x
org.eclipse.jetty / jetty-server 9.4.21.v20190926 9.4.24.v20191120
org.eclipse.jetty / jetty-server 9.4.22.v20191022 9.4.22.v20191022.x
org.eclipse.jetty / jetty-server 9.4.22.v20191022 9.4.24.v20191120
org.eclipse.jetty / jetty-server 9.4.23.v20191118 9.4.23.v20191118.x
org.eclipse.jetty / jetty-server 9.4.23.v20191118 9.4.24.v20191120