Session Hijacking Vulnerability in Eclipse Jetty by Eclipse Foundation
CVE-2018-12538

8.8HIGH

Key Information:

Vendor: The Eclipse Foundation
Status: Eclipse Jetty
Vendor: CVE Published:; 22 June 2018

🔔 Create The Eclipse Foundation Vulnerability Alert

What is CVE-2018-12538?

A vulnerability exists in certain versions of Eclipse Jetty where a malicious actor can exploit the FileSessionDataStore, which is used for persistent storage of HttpSession data. This flaw allows unauthorized users to access and hijack other users' HttpSessions and potentially delete unmatched sessions from the filesystem. Such an exploit poses a significant risk for web applications relying on the affected Jetty versions, making it essential for users to upgrade to a secure version to mitigate these risks.