GitHub Advisoryadvisory · Maven

GHSA-mwcx-532g-8pq3 Access and integrity issue within Eclipse Jetty

HIGH Published 2018-10-16 Modified 2022-04-26 Official page ↗
Aliases
CVE-2018-12538
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-384, CWE-6
Reviewed
2020-06-16

Affected packages

• Maven org.eclipse.jetty:jetty-server: >= 9.4.0, < 9.4.11.v20180605 → fixed in 9.4.11.v20180605

Description

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Related

Alias · CVE (1)

  • CVE-2018-12538 In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of… vulnerability

Weakness · CWE (2)

  • CWE-384 Session Fixation weakness
  • CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length weakness

References