Access and integrity issue within Eclipse Jetty
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-12538US | high8.8 | — | ||
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malic… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.securitytracker.com/id/1041194WEB
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018WEB
- https://github.com/advisories/GHSA-mwcx-532g-8pq3ADVISORY
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3EWEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-12538ADVISORY
- https://security.netapp.com/advisory/ntap-20181014-0001WEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan