CVE-2018-12538

Description

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystems storage for the FileSessionDataStore.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.515

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-7658,CVE-2017-7656,CVE-2018-12536,CVE-2018-12538 are fixed in Eclipse-jetty-server 9.4.11	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.3	Windows
Multiple Vulnerabilities are affected in Netapp Snapcenter -	Windows
Vulnerabilities CVE-2018-12538 are affected in Netapp Snapmanager -	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2.6.3	Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.11.0.1	Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.11.1	Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.10.4	Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.10.5.2	Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.12.0.1	Windows
Vulnerabilities CVE-2017-7658,CVE-2017-7656,CVE-2018-12536,CVE-2018-12538 are fixed in Eclipse-jetty-server for Linux 9.4.11	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234