Information disclosure in Jetty - CVE-2018-12536
Published: July 2, 2018
Vulnerability identifier: #VU13530
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-12536
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Eclipse
Affected software:
Jetty
Jetty
Detailed vulnerability description
The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to improper handling of queries that do not match the dynamic URL pattern for webapps that use default error handling settings. A remote attacker can send a query that submits malicious input, trigger a java.nio.file.InvalidPathException message, which could allow the attacker to view sensitive information, such as the software installation path.
How to mitigate CVE-2018-12536
The vulnerability is addressed in the versions 9.3.24.v20180605 and 9.4.11.v20180605.