Vulnerability Description
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Jetty | >= 9.0.0, <= 9.2.26 |
| Oracle | Retail Xstore Point Of Service | 7.1 |
Related Weaknesses (CWE)
References
- http://www.securitytracker.com/id/1041194Third Party AdvisoryVDB Entry
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670Vendor Advisory
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885
- https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
- https://security.netapp.com/advisory/ntap-20181014-0001/Third Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpeThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatchThird Party Advisory
- http://www.securitytracker.com/id/1041194Third Party AdvisoryVDB Entry
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670Vendor Advisory
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885
- https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
- https://security.netapp.com/advisory/ntap-20181014-0001/Third Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpeThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
FAQ
What is CVE-2018-12536?
CVE-2018-12536 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled...
How severe is CVE-2018-12536?
CVE-2018-12536 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12536?
Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Jetty, Oracle Retail Xstore Point Of Service.