Description
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | unspecified – < 9.4.9, 9.4.0 – < unspecified | 9.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | >= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 | GHSA-mwcx-532g-8pq3 |
References
- 1041194 vdb-entry
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018