CVE-2019-10241 @ Maven-org.eclipse.jetty:jetty-util-9.4.12.RC0

[cxronen]

Vulnerable Package issue exists @ Maven-org.eclipse.jetty:jetty-util-9.4.12.RC0 in branch master

In Eclipse Jetty versions 7, 8, 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client users a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: 8da575ca-6c79-4d57-ae63-b0e053c9ba06
Branch: master
Application: BookStore_VSCode
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-79

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 9.4.17.v20190418

---

References
Advisory
Mail Thread
Commit
Issue
Issue