CVE-2018-12538
Access and integrity issue within Eclipse Jetty
CVE-2018-12538 is a high vulnerability (CVSS 8.8) in Eclipse Jetty, published June 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.56%, the 85th percentile. Fixed in org.eclipse.jetty:jetty-server 9.4.11.v20180605.
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
- Record
CVE-2018-12538- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-6, CWE-384
- Updated
- 2026-11-02
CVE List No score
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
- Record
CVE-2018-12538- Weakness
- CWE-6
- Updated
- 2026-11-02
EUVDEUVD-2018-0645 No score
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
- Record
EUVD-2018-0645- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mwcx-532g-8pq3
Access and integrity issue within Eclipse Jetty
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
- Record
GHSA-mwcx-532g-8pq3- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-6, CWE-384
- Updated
- 2026-11-02
OSVGHSA-mwcx-532g-8pq3
Access and integrity issue within Eclipse Jetty
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
- Record
GHSA-mwcx-532g-8pq3- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384, CWE-6
- Updated
- 2026-11-02
Affected products
- eclipse jetty
- eclipse foundation jetty
- the eclipse foundation eclipse jetty
- netapp e-series santricity management plug-ins
- netapp e-series santricity os controller
- netapp e-series santricity web services proxy
- netapp element software
- netapp hyper converged infrastructure
- netapp oncommand system manager
- netapp oncommand unified manager
- netapp santricity cloud connector
- netapp snap creator framework
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-serverMaven |
9.4.0 to 9.4.10.v20180503 | 9.4.11.v20180605 |
org.eclipse.jetty:jetty-serverMaven |
9.4.0 up to 9.4.11.v20180605, plus listed versions 9.4.0.v201612089.4.0.v201806199.4.1.v201701209.4.1.v201806199.4.10.RC0 Show 18 moreShow less9.4.10.RC19.4.10.v201805039.4.2.v201702209.4.2.v201806199.4.3.v201703179.4.3.v201806199.4.4.v201704149.4.4.v201806199.4.5.v201705029.4.5.v201806199.4.6.v201705319.4.6.v201806199.4.7.RC09.4.7.v201709149.4.7.v201806199.4.8.v201711219.4.8.v201806199.4.9.v20180320 |
9.4.11.v20180605 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securitytracker.com/id/1041194
oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
security.netapp.com/advisory/ntap-20181014-0001
bugs.eclipse.org/bugs/show_bug.cgi?id=536018
nvd.nist.gov/vuln/detail/CVE-2018-12538
github.com/advisories/GHSA-mwcx-532g-8pq3