CVE-2019-17632: Cross-site Scripting

November 25, 2019 (updated December 4, 2019)

In Eclipse Jetty v20190926 v20191022 v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

References

bugs.eclipse.org/bugs/show_bug.cgi?id=553443
nvd.nist.gov/vuln/detail/CVE-2019-17632

Code Behaviors & Features

Detect and mitigate CVE-2019-17632 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →