Description
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Remediation
References
Related Vulnerabilities
WordPress Plugin CP Contact Form with PayPal Multiple Vulnerabilities (1.1.5)
WordPress Plugin Advanced XML Reader XML External Entity Information Disclosure (0.3.4)
WordPress Plugin Sharebar Cross-Site Scripting and SQL Injection Vulnerabilities (1.2.1)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7849)