← Back

CVE-2021-34428

nvd nist
Published: Jun 22, 2021Modified: Jun 17, 2026

JSON object

Loading...
3.5
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 0.9 / Impact: 2.5
Source: NVD

Description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Affected (19)

Show all products
Eclipse: Jetty · Debian: Debian Linux · Netapp: Active Iq Unified Manager, E Series Santricity Os Controller, E Series Santricity Web Services, Element Plug In For Vcenter Server, Santricity Cloud Connector, Snap Creator Framework, Snapmanager · Oracle: Autovue For Agile Product Lifecycle Management, Communications Element Manager, Communications Services Gatekeeper, Communications Session Report Manager, Communications Session Route Manager, Rest Data Services, Siebel Core Automation
Eclipse
1 product
Jetty
Debian
1 product
Debian Linux
Netapp
7 products
Active Iq Unified Manager
E Series Santricity Os Controller
E Series Santricity Web Services
Element Plug In For Vcenter Server
Santricity Cloud Connector
Snap Creator Framework
Snapmanager
Oracle
7 products
Autovue For Agile Product Lifecycle Management
Communications Element Manager
Communications Services Gatekeeper
Communications Session Report Manager
Communications Session Route Manager
Rest Data Services
Siebel Core Automation
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Eclipse
Jetty
Up to 9.4.40
Jetty
From 10.0.0 to 10.0.2
Jetty
From 11.0.0 to 11.0.2
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0
Configuration C
8 vulnerable
Vulnerable SoftwareAffected Versions
Netapp
Active Iq Unified Manager
All versions
Active Iq Unified Manager
All versions
E Series Santricity Os Controller
From 11.0 to 11.70.1
E Series Santricity Web Services
All versions
Element Plug In For Vcenter Server
All versions
Santricity Cloud Connector
All versions
Snap Creator Framework
All versions
Snapmanager
All versions
Configuration D
7 vulnerable
Vulnerable SoftwareAffected Versions
Autovue For Agile Product Lifecycle Management
Version 21.0.2
Communications Element Manager
Version 8.2.2
Communications Services Gatekeeper
Version 7.0
Communications Session Report Manager
From 8.0.0.0 to 8.2.4.0
Communications Session Route Manager
From 8.0.0 to 8.2.4.0
Rest Data Services
Before 21.3
Siebel Core Automation
Up to 21.9

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (24)

Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Third Party Advisory
Source: emo@eclipse.org
Not ApplicableThird Party Advisory
Source: emo@eclipse.org
PatchThird Party Advisory
Source: emo@eclipse.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not ApplicableThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.