Description

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Remediation

References

CVE-2018-12538

Related Vulnerabilities

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-25145)

WordPress Plugin WordPress Backup and Migrate-Backup Guard Cross-Site Scripting (1.1.46)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3828)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2154)

OpenSSL Session Fixation Vulnerability (CVE-1999-0428)

Severity

High

Classification

CVE-2018-12538 CWE-384 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities