mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
78 lines
2.4 KiB
JSON
78 lines
2.4 KiB
JSON
{
|
|
"CVE_data_meta" : {
|
|
"ASSIGNER" : "emo@eclipse.org",
|
|
"ID" : "CVE-2018-12538",
|
|
"STATE" : "PUBLIC"
|
|
},
|
|
"affects" : {
|
|
"vendor" : {
|
|
"vendor_data" : [
|
|
{
|
|
"product" : {
|
|
"product_data" : [
|
|
{
|
|
"product_name" : "Eclipse Jetty",
|
|
"version" : {
|
|
"version_data" : [
|
|
{
|
|
"version_affected" : "<",
|
|
"version_value" : "9.4.9"
|
|
},
|
|
{
|
|
"version_affected" : ">=",
|
|
"version_value" : "9.4.0"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"vendor_name" : "The Eclipse Foundation"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"data_format" : "MITRE",
|
|
"data_type" : "CVE",
|
|
"data_version" : "4.0",
|
|
"description" : {
|
|
"description_data" : [
|
|
{
|
|
"lang" : "eng",
|
|
"value" : "In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore."
|
|
}
|
|
]
|
|
},
|
|
"problemtype" : {
|
|
"problemtype_data" : [
|
|
{
|
|
"description" : [
|
|
{
|
|
"lang" : "eng",
|
|
"value" : "CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"references" : {
|
|
"reference_data" : [
|
|
{
|
|
"name" : "https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018",
|
|
"refsource" : "CONFIRM",
|
|
"url" : "https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018"
|
|
},
|
|
{
|
|
"name" : "https://security.netapp.com/advisory/ntap-20181014-0001/",
|
|
"refsource" : "CONFIRM",
|
|
"url" : "https://security.netapp.com/advisory/ntap-20181014-0001/"
|
|
},
|
|
{
|
|
"name" : "1041194",
|
|
"refsource" : "SECTRACK",
|
|
"url" : "http://www.securitytracker.com/id/1041194"
|
|
}
|
|
]
|
|
}
|
|
}
|