NetSight
IP …
high8.8

CVE-2018-12538

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is…

Impact

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Affected products

VendorProductAffected versions
EclipseJetty
from 9.4.0 through 9.4.8
NetappE-Series Santricity Management Plug-Ins
All versions
NetappE-Series Santricity Os Controller
from 11.0 through 11.40
NetappE-Series Santricity Web Services Proxy
All versions
NetappElement Software
All versions
NetappHyper Converged Infrastructure
All versions
NetappOncommand System Manager
from 3.0.0 through 3.1.3
NetappOncommand Unified Manager
All versions
NetappSantricity Cloud Connector
All versions
NetappSnap Creator Framework
All versions
NetappSnapcenter
All versions
NetappSnapmanager
All versions

Weakness classification

CWE-6CWE-384

References