CVE-2018-12538
First published: Fri Jun 22 2018(Updated: )
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Credit: emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Jetty | >=9.4.0<=9.4.8 | |
| Netapp E-series Santricity Management Plug-ins | ||
| NetApp E-Series SANtricity OS Controller | >=11.0<=11.40 | |
| Netapp E-series Santricity Web Services Proxy | ||
| Netapp Element Software | ||
| Netapp Hyper Converged Infrastructure | ||
| NetApp OnCommand System Manager | >=3.0.0<=3.1.3 | |
| Netapp Oncommand Unified Manager | ||
| Netapp Santricity Cloud Connector | ||
| NetApp Snap Creator Framework | ||
| Netapp Snapcenter | ||
| Netapp Snapmanager |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securitytracker.com/id/1041194
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Frequently Asked Questions
What is CVE-2018-12538?
CVE-2018-12538 is a vulnerability in Eclipse Jetty versions 9.4.0 through 9.4.8 that allows a malicious user to access and hijack other HttpSessions and delete unmatched HttpSessions stored in the FileSystem's storage.
What is the severity of CVE-2018-12538?
CVE-2018-12538 has a severity rating of 8.8 (high).
Which software is affected by CVE-2018-12538?
The following software are affected by CVE-2018-12538: Eclipse Jetty, NetApp E-series Santricity Management Plug-ins, NetApp E-Series SANtricity OS Controller, Netapp E-series Santricity Web Services Proxy, Netapp Element Software, Netapp Hyper Converged Infrastructure, NetApp OnCommand System Manager, Netapp Oncommand Unified Manager, IBM Cloud Pak for Automation, NetApp Snap Creator Framework, Netapp Snapcenter, Netapp Snapmanager.
How can I fix CVE-2018-12538?
To fix CVE-2018-12538, you should upgrade to a version of Eclipse Jetty that is higher than 9.4.8.
Where can I find more information about CVE-2018-12538?
You can find more information about CVE-2018-12538 at the following references: [http://www.securitytracker.com/id/1041194](http://www.securitytracker.com/id/1041194), [https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018](https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018), [https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E](https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E)
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/eclipse
- canonical/eclipse jetty
- version/eclipse jetty/9.4.0
- version/eclipse jetty/9.4.8
- vendor/netapp
- canonical/netapp e-series santricity management plug-ins
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0
- version/netapp e-series santricity os controller/11.40
- canonical/netapp e-series santricity web services proxy
- canonical/netapp element software
- canonical/netapp hyper converged infrastructure
- canonical/netapp oncommand system manager
- version/netapp oncommand system manager/3.0.0
- version/netapp oncommand system manager/3.1.3
- canonical/netapp oncommand unified manager
- canonical/netapp santricity cloud connector
- canonical/netapp snap creator framework
- canonical/netapp snapcenter
- canonical/netapp snapmanager