#VU13531 Session fixation attack in Jetty - CVE-2018-12538

Vulnerability identifier: #VU13531

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12538

CWE-ID: CWE-384

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jetty
Server applications / Web servers

Vendor: Eclipse

Description

The vulnerability allows a remote attacker to a session fixation attack on a target system.

The vulnerability exists due to improper security restrictions when the FileSessionDataStore class is used for persistent storage of HTTP session details. A remote attacker can submit a partial session ID, delete other unmatched HTTP sessions from filesystem storage for the FileSessionDataStore class and hijack existing HTTP sessions or cause the service to crash.

Mitigation
Update to version 9.4.9.v20180320 or later.

Vulnerable software versions

Jetty: 9.4.0.v20161207 - 9.4.8.v20171121

---

External links
https://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00123.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.