icon

We found results for “

CVE-2018-12538

Good to know:

icon
icon

Date: June 22, 2018

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Language: Java

Severity Score

Severity Score

Weakness Type (CWE)

Session Fixation

CWE-384

Top Fix

icon

Upgrade Version

Upgrade to version org.eclipse.jetty:jetty-server:9.4.12.RC0,org.eclipse.jetty:jetty-runner:9.4.12.RC0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us