eclipse jetty CVE-2021-34428 vulnerability in Eclipse and Other Products
Published on June 22, 2021

product logo product logo product logo product logo
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2021-34428 is exploitable with physical access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
PHYSICAL
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."


Products Associated with CVE-2021-34428

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-34428 are published in these products:

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Affected Versions

The Eclipse Foundation Eclipse Jetty:

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-34428

Package Manager Vulnerable Package Versions Fixed In
maven org.eclipse.jetty:jetty-server <= 9.4.40 9.4.41
maven org.eclipse.jetty:jetty-server >= 10.0.0, <= 10.0.2 10.0.3
maven org.eclipse.jetty:jetty-server >= 11.0.0, <= 11.0.2 11.0.3

Exploit Probability

EPSS
0.67%
Percentile
71.06%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.