VDB

CVE-2018-12538

CVE-2018-12538 PUBLISHED CVSS 8.800000190734863 HIGH

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

EPSS 0.52% · 67.0th percentile

Risk Scores

CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.52%
67.0th percentile

Affected Products

VendorProductVersions
netappelement_software
netappe-series_santricity_os_controller11.0
netappsnapcenter
eclipsejetty9.4.0
netapponcommand_system_manager3.0.0
The Eclipse FoundationEclipse Jettyunspecified, 9.4.0
netapphyper_converged_infrastructure
netappsnapmanager
Mavenorg.eclipse.jetty:jetty-server9.4.0
netappsantricity_cloud_connector
netappe-series_santricity_management_plug-ins
netappe-series_santricity_web_services_proxy
netapponcommand_unified_manager
netappsnap_creator_framework

Exploit Intelligence

Timeline

  • Jun 22, 2018 CVE Published
  • Oct 9, 2019 CVE Updated
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • May 2, 2022 EPSS Score
  • Jul 3, 2022 EPSS Score
  • Sep 5, 2022 EPSS Score
  • Nov 6, 2022 EPSS Score
  • Jan 8, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›