{"id":"CVE-2018-12538","aliases":["EUVD-2018-0645","GHSA-mwcx-532g-8pq3"],"status":"published","title":"Access and integrity issue within Eclipse Jetty","description":"In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0256,"percentile":0.85224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-384","CWE-6"],"published":"2018-06-22T19:00:00Z","modified":"2026-06-17T01:37:55Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["9.4.11.v20180605"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"last_affected":"9.4.10.v20180503"},{"fixed":"9.4.11.v20180605"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"fixed":"9.4.11.v20180605"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.2.v20170220","9.4.2.v20180619","9.4.3.v20170317","9.4.3.v20180619","9.4.4.v20170414","9.4.4.v20180619","9.4.5.v20170502","9.4.5.v20180619","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"netapp","product":"e-series_santricity_management_plug-ins"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_web_services_proxy"},{"vendor":"netapp","product":"element_software"},{"vendor":"netapp","product":"hyper_converged_infrastructure"},{"vendor":"netapp","product":"oncommand_system_manager"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"netapp","product":"santricity_cloud_connector"},{"vendor":"netapp","product":"snap_creator_framework"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"the eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"http://www.securitytracker.com/id/1041194","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20181014-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12538","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mwcx-532g-8pq3","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20181014-0001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12538","description":"In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","status":"published","published":"2018-06-22T19:00:00Z","modified":"2024-08-05T08:38:06.131Z","cwes":["CWE-6"],"updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-0645","description":"In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","status":"published","published":"2018-06-22T19:00:00Z","modified":"2024-08-05T08:38:06Z","updated_at":"2026-11-03T02:39:52.61924Z"}],"ghsa":[{"id":"GHSA-mwcx-532g-8pq3","title":"Access and integrity issue within Eclipse Jetty","description":"In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","status":"published","published":"2018-10-16T17:44:11Z","modified":"2023-01-09T05:03:33Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-6","CWE-384"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2018-12538","description":"In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","status":"published","published":"2018-06-22T19:29:00.22Z","modified":"2026-06-17T01:37:55.947Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-6","CWE-384"],"updated_at":"2026-11-02T14:04:30.900603Z"}],"osv":[{"id":"GHSA-mwcx-532g-8pq3","title":"Access and integrity issue within Eclipse Jetty","description":"In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","status":"published","published":"2018-10-16T17:44:11Z","modified":"2024-02-17T05:43:52.147542Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-384","CWE-6"],"updated_at":"2026-11-02T15:46:52.534897Z"}]}}