Vulnerability in Eclipse Jetty
CVE-2021-34428
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.9 (Low). Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.010 (61.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 62nd percentile — 61.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Eclipse Jetty
- NetApp Active Iq Unified Manager
- NetApp Element Plug-In For Vcenter Server
- NetApp E-Series Santricity OS Controller
- NetApp E-Series Santricity Web Services
- NetApp Santricity Cloud Connector
- NetApp Snap Creator Framework
- NetApp Snapmanager
- Oracle Autovue For Agile Product Lifecycle Management — versions 21.0.2
- Oracle Communications Element Manager — versions 8.2.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-65j6 (Third Party Advisory)
- lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f8… (mailing-list)
- www.debian.org/security/2021/dsa-4949 (vendor-advisory, Third Party Advisory)
- lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff… (mailing-list)
- lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db1… (mailing-list)
- lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f90… (mailing-list)
- www.oracle.com/security-alerts/cpuoct2021.html (Patch, Third Party Advisory)
- lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34d…
- lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29e…
- security.netapp.com/advisory/ntap-20210813-0003/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-34428?
- CVE-2021-34428 is a low-severity vulnerability in Eclipse Jetty, classified under Insufficient Session Expiration. CVSS score: 2.9/10. Published 2021-06-22.
- How severe is CVE-2021-34428?
- Low severity. CVSS v3 base score is 2.9 out of 10.
- Is CVE-2021-34428 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.