CVE-2018-12538 Access and integrity issue within Eclipse Jetty
Attackers can hijack or delete other users' sessions when using the optional FileSessionDataStore in Eclipse Jetty.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12538?
CVE-2018-12538 is a high-severity missing authorization vulnerability in Eclipse Jetty, published on 22 Jun 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Which versions are affected by CVE-2018-12538?
2 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.11.v20180605 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.11.v20180605 |
Products include Eclipse Jetty, Netapp E-Series Santricity Management Plug-Ins, Netapp E-Series Santricity Os Controller, Netapp E-Series Santricity Web Services Proxy, Netapp Element Software, Netapp Hyper Converged Infrastructure and 6 more.
How do I fix CVE-2018-12538?
Upgrade org.eclipse.jetty:jetty-server to 9.4.11.v20180605 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-12538 being exploited?
There is no known exploitation of CVE-2018-12538 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
- CVE-2024-7708 Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Sources
Also known as GHSA-mwcx-532g-8pq3.