GHSA-5h9j-q6j2-253fMediumCVSS 6.1

Unescaped exception messages in error responses in Jetty

Published
December 2, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-17632 →

📋 Description

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

🎯 Affected products3

  • maven/org.eclipse.jetty:jetty-server:= 9.4.21.v20190926
  • maven/org.eclipse.jetty:jetty-server:= 9.4.22.v20191022
  • maven/org.eclipse.jetty:jetty-server:= 9.4.23.v20191118

🔗 References (6)