Strix
26.1K

CVE-2021-34428

LOWCVSS 3.5/10EPSS 0.96%

Last modified

CVE-2021-34428 is a low-severity vulnerability rated 3.5/10 on the CVSS scale. For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. EPSS estimates a 0.96% chance of exploitation in the next 30 days.

Description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Metrics

CVSS 3.1
3.5/10

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Probability
0.96%

57.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
EclipseJetty<= 9.4.40
EclipseJetty>= 10.0.0, <= 10.0.2
EclipseJetty>= 11.0.0, <= 11.0.2
DebianDebian Linux10.0
NetappActive Iq Unified ManagerAll versions
NetappE-Series Santricity Os Controller>= 11.0, <= 11.70.1
NetappE-Series Santricity Web ServicesAll versions
NetappElement Plug-In For Vcenter ServerAll versions
NetappSantricity Cloud ConnectorAll versions
NetappSnap Creator FrameworkAll versions
NetappSnapmanagerAll versions
OracleAutovue For Agile Product Lifecycle Management21.0.2
OracleCommunications Element Manager8.2.2
OracleCommunications Services Gatekeeper7.0
OracleCommunications Session Report Manager>= 8.0.0.0, <= 8.2.4.0
OracleCommunications Session Route Manager>= 8.0.0, <= 8.2.4.0
OracleRest Data Services< 21.3
OracleSiebel Core - Automation<= 21.9

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-34428?
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
How severe is CVE-2021-34428?
CVE-2021-34428 has a CVSS score of 3.5/10 (LOW severity). The EPSS model estimates a 0.96% probability of exploitation in the next 30 days.
How do I fix CVE-2021-34428?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-34428?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST