| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 |
| jetty | ≥ 9.4.0, ≤ 9.4.8 | |
| e-series santricity os controller | ≥ 11.0, ≤ 11.40 | |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 |
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free