CVE-2018-12538

Published: Jun 22, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

Affected (12)

Products: Eclipse: Jetty · Netapp: E Series Santricity Management Plug Ins, E Series Santricity Os Controller, E Series Santricity Web Services Proxy, Element Software, Hyper Converged Infrastructure, Oncommand System Manager, Oncommand Unified Manager, Santricity Cloud Connector, Snap Creator Framework, Snapcenter, Snapmanager

Eclipse

1 product

Jetty

Netapp

11 products

E Series Santricity Management Plug Ins

E Series Santricity Os Controller

E Series Santricity Web Services Proxy

Element Software

Hyper Converged Infrastructure

Oncommand System Manager

Oncommand Unified Manager

Santricity Cloud Connector

Snap Creator Framework

Snapcenter

Snapmanager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Jetty	From 9.4.0 to 9.4.8

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Netapp E Series Santricity Management Plug Ins	All versions
Netapp E Series Santricity Os Controller	From 11.0 to 11.40
Netapp E Series Santricity Web Services Proxy	All versions
Netapp Element Software	All versions
Netapp Hyper Converged Infrastructure	All versions
Netapp Oncommand System Manager	From 3.0.0 to 3.1.3
Netapp Oncommand Unified Manager	All versions
Netapp Santricity Cloud Connector	All versions
Netapp Snap Creator Framework	All versions
Netapp Snapcenter	All versions
Netapp Snapmanager	All versions