CVE-2019-17632

2019-11-2521:56:15

CWE-79

eclipse

www.cve.org

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

45.4%

JSON

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

CNA Affected

[
  {
    "product": "Eclipse Jetty",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "9.4.21.v20190926"
      },
      {
        "status": "affected",
        "version": "9.4.22.v20191022"
      },
      {
        "status": "affected",
        "version": "9.4.23.v20191118"
      }
    ]
  }
]