Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-12536

CVE-2018-12536: Eclipse Jetty Server generates error message containing sensitive information

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-12536
GHSA ID
GHSA-9rgv-h7x4-qw8g
EPSS Score
0.84191%
CWE
CWE-209
Published
10/19/2018
Updated
8/18/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.eclipse.jetty:jetty-servermaven>= 9.4.0, <= 9.4.10.v201805039.4.11.v20180605
org.eclipse.jetty:jetty-servermaven>= 9.0.0, <= 9.3.23.v201802289.3.24.v20180605

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability occurs when DefaultServlet's static file handling throws an InvalidPathException containing the server path, which is then exposed by the default ErrorHandler. The doGet() method in DefaultServlet processes requests and constructs resource paths, potentially triggering the exception. The ErrorHandler's handle() method propagates this sensitive information to clients through error responses. Both components directly contribute to the information leak as described in CVE-2018-12536.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In **lips* J*tty S*rv*r, *ll *.x v*rsions, on w***pps **ploy** usin* ****ult *rror **n*lin*, w**n *n int*ntion*lly *** qu*ry *rriv*s t**t *o*sn't m*t** * *yn*mi* url-p*tt*rn, *n* is *v*ntu*lly **n*l** *y t** ****ultS*rvl*t's st*ti* *il* s*rvin*, t**

Reasoning

T** vuln*r**ility o**urs w**n `****ultS*rvl*t`'s st*ti* *il* **n*lin* t*rows *n `Inv*li*P*t**x**ption` *ont*inin* t** s*rv*r p*t*, w*i** is t**n *xpos** *y t** ****ult `*rror**n*l*r`. T** `*o**t()` m*t*o* in `****ultS*rvl*t` pro**ss*s r*qu*sts *n* *o