Session Hijacking Vulnerability in Eclipse Jetty by Eclipse Foundation

CVE-2018-12538

What is CVE-2018-12538?

A vulnerability exists in certain versions of Eclipse Jetty where a malicious actor can exploit the FileSessionDataStore, which is used for persistent storage of HttpSession data. This flaw allows unauthorized users to access and hijack other users' HttpSessions and potentially delete unmatched sessions from the filesystem. Such an exploit poses a significant risk for web applications relying on the affected Jetty versions, making it essential for users to upgrade to a secure version to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References