Access and integrity issue within Eclipse Jetty · CVE-2018-12538 · GitHub Advisory Database · GitHub

Access and integrity issue within Eclipse Jetty

High severity GitHub Reviewed Published Oct 16, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

org.eclipse.jetty:jetty-server (Maven)

Affected versions

>= 9.4.0, <= 9.4.10.v20180503

Patched versions

9.4.11.v20180605

Description

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

References

Published to the GitHub Advisory Database Oct 16, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H