Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2018-12536
Modified
More InfoOfficial Page
Source-emo@eclipse.org
View Known Exploited Vulnerability (KEV) details
Published At-27 Jun, 2018 | 17:29
Updated At-07 Nov, 2023 | 02:52

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.15.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary2.05.0MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
Type: Primary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Type: Primary
Version: 2.0
Base score: 5.0
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE Matches

Eclipse Foundation AISBL
eclipse
>>jetty>>Versions from 9.0.0(inclusive) to 9.2.26(inclusive)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Eclipse Foundation AISBL
eclipse
>>jetty>>Versions from 9.3.0(inclusive) to 9.3.24(exclusive)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Eclipse Foundation AISBL
eclipse
>>jetty>>Versions from 9.4.0(inclusive) to 9.4.11(exclusive)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Oracle Corporation
oracle
>>retail_xstore_point_of_service>>7.1
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
Oracle Corporation
oracle
>>retail_xstore_point_of_service>>15.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
Oracle Corporation
oracle
>>retail_xstore_point_of_service>>16.0.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.0:*:*:*:*:*:*:*
Oracle Corporation
oracle
>>retail_xstore_point_of_service>>17.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
NVD-CWE-noinfoPrimarynvd@nist.gov
CWE-209Secondaryemo@eclipse.org
CWE ID: NVD-CWE-noinfo
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-209
Type: Secondary
Source: emo@eclipse.org
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
http://www.securitytracker.com/id/1041194emo@eclipse.org
Third Party Advisory
VDB Entry
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670emo@eclipse.org
Vendor Advisory
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Eemo@eclipse.org
N/A
https://lists.debian.org/debian-lts-announce/2021/05/msg00016.htmlemo@eclipse.org
N/A
https://security.netapp.com/advisory/ntap-20181014-0001/emo@eclipse.org
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_usemo@eclipse.org
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlemo@eclipse.org
N/A
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlemo@eclipse.org
Patch
Third Party Advisory
Hyperlink: http://www.securitytracker.com/id/1041194
Source: emo@eclipse.org
Resource:
Third Party Advisory
VDB Entry
Hyperlink: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670
Source: emo@eclipse.org
Resource:
Vendor Advisory
Hyperlink: https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
Source: emo@eclipse.org
Resource: N/A
Hyperlink: https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
Source: emo@eclipse.org
Resource: N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20181014-0001/
Source: emo@eclipse.org
Resource:
Third Party Advisory
Hyperlink: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
Source: emo@eclipse.org
Resource:
Third Party Advisory
Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html
Source: emo@eclipse.org
Resource: N/A
Hyperlink: https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Source: emo@eclipse.org
Resource:
Patch
Third Party Advisory
Change History
0Changes found

Details not found