[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4nwGlVKgXaNQ7EP3banSnH6u8kmZNVFls1_im8AiIH4":3,"g5a-risk:CVE-2018-12538":202},{"success":4,"data":5,"meta":200},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":40,"epssPercentile":15,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":84,"references":85,"referencesCount":113,"weaknesses":114,"weaknessesCount":130,"isActivelyExploited":131,"cisaInfo":15,"otxData":15,"relatedBlogPosts":132,"seoMetadata":133,"configurations":158,"relatedVendorCves":198,"notableEvents":199},"CVE-2018-12538","What is CVE-2018-12538?","In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access\u002Fhijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.","In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it ...","2018-06-22T19:29:00.22","2023-11-07T02:52:20.017",8.8,"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":29,"CVSSMetricV40":15},null,[17],{"Source":18,"Type":19,"CVSSData":20,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":21,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"TemporalSeverity":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"ModifiedAttackVector":15,"ModifiedAttackComplexity":15,"ModifiedPrivilegesRequired":15,"ModifiedUserInteraction":15,"ModifiedScope":15,"ModifiedConfidentialityImpact":15,"ModifiedIntegrityImpact":15,"ModifiedAvailabilityImpact":15,"EnvironmentalScore":15,"EnvironmentalSeverity":15},"3.0","NETWORK","LOW","NONE","UNCHANGED","HIGH",2.8,5.9,[30],{"Source":18,"Type":19,"CVSSData":31,"BaseSeverity":37,"ExploitabilityScore":38,"ImpactScore":39,"ACInsufInfo":15,"ObtainAllPrivilege":15,"ObtainUserPrivilege":15,"ObtainOtherPrivilege":15,"UserInteractionRequired":15},{"Version":32,"VectorString":33,"AccessVector":22,"AccessComplexity":23,"Authentication":34,"ConfidentialityImpact":35,"IntegrityImpact":35,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":15,"Exploitability":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"CollateralDamagePotential":15,"TargetDistribution":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"EnvironmentalScore":15},"2.0","AV:N\u002FAC:L\u002FAu:S\u002FC:P\u002FI:P\u002FA:P","SINGLE","PARTIAL",6.5,"MEDIUM",8,6.4,0.02654,[40,40,40,40,40,40,40],"High",[44,49,54,57,60,63,66,69,72,75,78,81],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"eclipse","jetty","*","cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",{"vendor":50,"product":51,"version":52,"criteria":53,"vulnerable":4},"netapp","e-series_santricity_management_plug-ins","-","cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:*:*:*",{"vendor":50,"product":55,"version":47,"criteria":56,"vulnerable":4},"e-series_santricity_os_controller","cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",{"vendor":50,"product":58,"version":52,"criteria":59,"vulnerable":4},"e-series_santricity_web_services_proxy","cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*",{"vendor":50,"product":61,"version":52,"criteria":62,"vulnerable":4},"element_software","cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*",{"vendor":50,"product":64,"version":52,"criteria":65,"vulnerable":4},"hyper_converged_infrastructure","cpe:2.3:a:netapp:hyper_converged_infrastructure:-:*:*:*:*:*:*:*",{"vendor":50,"product":67,"version":47,"criteria":68,"vulnerable":4},"oncommand_system_manager","cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",{"vendor":50,"product":70,"version":52,"criteria":71,"vulnerable":4},"oncommand_unified_manager","cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:*:*:*",{"vendor":50,"product":73,"version":52,"criteria":74,"vulnerable":4},"santricity_cloud_connector","cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*",{"vendor":50,"product":76,"version":52,"criteria":77,"vulnerable":4},"snap_creator_framework","cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*",{"vendor":50,"product":79,"version":52,"criteria":80,"vulnerable":4},"snapcenter","cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",{"vendor":50,"product":82,"version":52,"criteria":83,"vulnerable":4},"snapmanager","cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:*:*:*",12,[86,92,98,102,106,110],{"url":87,"source":88,"tags":89},"http:\u002F\u002Fwww.securitytracker.com\u002Fid\u002F1041194","Securitytracker",[90,91],"Third Party Advisory","VDB Entry",{"url":93,"source":94,"tags":95},"https:\u002F\u002Fbugs.eclipse.org\u002Fbugs\u002Fshow_bug.cgi?id=536018","Eclipse",[96,97],"Issue Tracking","Vendor Advisory",{"url":99,"source":100,"tags":101},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","Apache",[],{"url":103,"source":104,"tags":105},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20181014-0001\u002F","Netapp",[90],{"url":107,"source":108,"tags":109},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpuoct2020.html","Oracle",[],{"url":111,"source":108,"tags":112},"https:\u002F\u002Fwww.oracle.com\u002Ftechnetwork\u002Fsecurity-advisory\u002Fcpuoct2019-5072832.html",[],6,[115,123],{"id":116,"name":117,"description":118,"extendedDescription":119,"status":120,"abstraction":121,"structure":122},"CWE-384","Session Fixation","Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.","Such a scenario is commonly observed when:\nIn the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.","Incomplete","Compound","Composite",{"id":124,"name":125,"description":126,"extendedDescription":127,"status":120,"abstraction":128,"structure":129},"CWE-6","J2EE Misconfiguration: Insufficient Session-ID Length","The J2EE application is configured to use an insufficient session ID length.","If an attacker can guess or steal a session ID, then they may be able to take over the user's session (called session hijacking). The number of possible session IDs increases with increased session ID length, making it more difficult to guess or steal a session ID.","Variant","Simple",2,false,[],{"title":134,"metaDescription":135,"keywords":136,"canonicalUrl":137,"structuredData":138},"What is CVE-2018-12538? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2018-12538, a high severity cyber security vulnerability from 2018. In Eclipse Jetty versions 9.4.0 through 9.4.8, when using t...","CVE-2018-12538, CVE-2018-12538 vulnerability, CVE-2018-12538 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2018, CVSS score, exploit, patch, remediation, eclipse security, netapp security, jetty vulnerability, e-series_santricity_management_plug-ins vulnerability, e-series_santricity_os_controller vulnerability, e-series_santricity_web_services_proxy vulnerability, element_software vulnerability","\u002Fwhat-is\u002Fcve-2018-12538",{"@context":139,"@type":140,"headline":134,"description":135,"datePublished":10,"dateModified":11,"author":141,"publisher":145,"about":149,"mainEntityOfPage":153,"articleSection":156,"keywords":157},"https:\u002F\u002Fschema.org","TechArticle",{"@type":142,"name":143,"url":144},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":142,"name":143,"url":144,"logo":146},{"@type":147,"url":148},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":150,"name":6,"description":151,"additionalType":152},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":154,"@id":155},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2018-12538","Cybersecurity","CVE-2018-12538, CVE-2018-12538 vulnerability, CVE-2018-12538 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[159,168],{"Operator":15,"Negate":15,"Nodes":160},[161],{"Operator":162,"Negate":15,"CPEMatch":163},"OR",[164],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":165,"VersionStartExcluding":15,"VersionStartIncluding":166,"VersionEndExcluding":15,"VersionEndIncluding":167},"0AC29420-F772-43D0-89AE-2071F4838B2E","9.4.0","9.4.8",{"Operator":15,"Negate":15,"Nodes":169},[170],{"Operator":162,"Negate":15,"CPEMatch":171},[172,174,178,180,182,184,188,190,192,194,196],{"Vulnerable":4,"Criteria":53,"MatchCriteriaID":173,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"20B49859-49F0-439B-AEF8-79EF71DA0D73",{"Vulnerable":4,"Criteria":56,"MatchCriteriaID":175,"VersionStartExcluding":15,"VersionStartIncluding":176,"VersionEndExcluding":15,"VersionEndIncluding":177},"9C82200F-A26E-4AD4-82FF-DC5601A28D52","11.0","11.40",{"Vulnerable":4,"Criteria":59,"MatchCriteriaID":179,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"23F148EC-6D6D-4C4F-B57C-CFBCD3D32B41",{"Vulnerable":4,"Criteria":62,"MatchCriteriaID":181,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"85DF4B3F-4BBC-42B7-B729-096934523D63",{"Vulnerable":4,"Criteria":65,"MatchCriteriaID":183,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"893C0367-DD1A-4754-B9E0-4944344108EC",{"Vulnerable":4,"Criteria":68,"MatchCriteriaID":185,"VersionStartExcluding":15,"VersionStartIncluding":186,"VersionEndExcluding":15,"VersionEndIncluding":187},"34B80C9D-62AA-42FA-AB46-F8A414FCBE5E","3.0.0","3.1.3",{"Vulnerable":4,"Criteria":71,"MatchCriteriaID":189,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"C18CA4B5-28FD-4199-B1F0-B1E59E920370",{"Vulnerable":4,"Criteria":74,"MatchCriteriaID":191,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"AB15BCF1-1B1D-49D8-9B76-46DCB10044DB",{"Vulnerable":4,"Criteria":77,"MatchCriteriaID":193,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"9F4754FB-E3EB-454A-AB1A-AE3835C5350C",{"Vulnerable":4,"Criteria":80,"MatchCriteriaID":195,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94",{"Vulnerable":4,"Criteria":83,"MatchCriteriaID":197,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"912520F1-3717-457F-9F05-88BDAB3E5DF9",[],[],{"lastModified":11,"cacheTime":201,"version":32},1792356279482,{"score":203,"band":204,"action":205,"scoredAt":206},49,"Medium","Plan remediation","2026-10-16T06:44:19.886392+00:00"]