Description

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Remediation

References

CVE-2018-12538

Related Vulnerabilities

Moodle Other Vulnerability (CVE-2015-3272)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-12647)

YUI Library Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5882)

WordPress Plugin TaxoPress-Create and Manage Taxonomies, Tags, Categories Cross-Site Scripting (3.0.7.1)

WordPress Plugin Copify Cross-Site Request Forgery (1.3.0)

Severity

High

Classification

CVE-2018-12538 CWE-384 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities