CVE-2018-12538: Access and Integrity Issue in Eclipse Jetty
Summary
CVE-2018-12538: Access and integrity issue within Eclipse Jetty. Affects org.eclipse.jetty:jetty-server versions >= 9.4.0, < 9.4.11.v20180605. Fixed in 9.4.11.v20180605. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a popular Java-based web server and servlet container. It provides a lightweight and scalable solution for serving web applications. The Jetty server is widely used in various Java-based frameworks and applications. However, versions 9.4.0 through 9.4.8 of Jetty are vulnerable to an access and integrity issue when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details.
Vulnerability Detail
The vulnerability, identified as CVE-2018-12538, allows a malicious user to access and hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore. This means that an attacker can potentially gain unauthorized access to sensitive session data of other users and manipulate or delete their sessions. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.4.11.v20180605
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the use of the Jetty provided FileSessionDataStore and switch to an alternative session storage mechanism. This can be achieved by configuring the web application to use a different session storage implementation, such as a database or an in-memory store. By avoiding the use of the vulnerable FileSessionDataStore, the risk of session hijacking and unauthorized access can be mitigated.
Conclusion
In conclusion, the access and integrity issue in Eclipse Jetty versions 9.4.0 through 9.4.8 poses a significant security risk, allowing unauthorized access and manipulation of HttpSessions. It is crucial to upgrade to the latest version of Jetty or apply the recommended workaround to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
Eclipse Jetty is a Java-based web server and servlet container that provides a lightweight and scalable solution for serving web applications.
The vulnerability allows a malicious user to access and hijack other HttpSessions and even delete unmatched HttpSessions, potentially compromising the security and integrity of the affected web application.
To fix this vulnerability, it is recommended to upgrade to Jetty version 9.4.11.v20180605 or later. Alternatively, you can disable the use of the vulnerable FileSessionDataStore and switch to a different session storage mechanism.
Yes, if upgrading to the latest version is not immediately feasible, you can temporarily disable the use of the Jetty provided FileSessionDataStore and configure the web application to use an alternative session storage implementation.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
