CVEvulnerability

CVE-2021-34428

3.5 LOW Published 2021-06-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-06-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.9 LOW — CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
3.5 LOW — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-613

Description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Affected configurations

• eclipse jetty (<= 9.4.40) • eclipse jetty (>= 10.0.0 <= 10.0.2) • eclipse jetty (>= 11.0.0 <= 11.0.2) • debian debian linux 10.0 • netapp active iq unified manager • netapp e-series santricity os controller (>= 11.0 <= 11.70.1) • netapp e-series santricity web services • netapp element plug-in for vcenter server • netapp santricity cloud connector • netapp snap creator framework • netapp snapmanager • oracle autovue for agile product lifecycle management 21.0.2 • oracle communications element manager 8.2.2 • oracle communications services gatekeeper 7.0 • oracle communications session report manager (>= 8.0.0.0 <= 8.2.4.0) • oracle communications session route manager (>= 8.0.0 <= 8.2.4.0) • oracle rest data services (< 21.3) • oracle siebel core - automation (<= 21.9)

Related

Weakness · not in database (1)

References