Vulnerability record · CVE-2018-12538 · published 22 June 2018

CVE-2018-12538: Eclipse jetty vulnerability

Eclipse · Jetty

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

8.8 CVSS 3.0 High EPSS 2.7% · top 14.9% CWE-6 · CWE-6CWE-384 · CWE-384

8.8CVSS 3.0 base score, v2 6.5

2.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

12Affected product versions listed by NVD

12References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

12 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Jetty Eclipse NE Series Santricity Management Plug Ins Netapp NE Series Santricity Os Controller Netapp NE Series Santricity Web Services Proxy Netapp NElement Software Netapp NHyper Converged Infrastructure Netapp NOncommand System Manager Netapp NOncommand Unified Manager Netapp NSantricity Cloud Connector Netapp NSnap Creator Framework Netapp NSnapcenter Netapp NSnapmanager Netapp

References

Link	Tags
http://www.securitytracker.com/id/1041194	Third Party AdvisoryVDB Entry
https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018	Issue TrackingVendor Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.ap
https://security.netapp.com/advisory/ntap-20181014-0001/	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
http://www.securitytracker.com/id/1041194	Third Party AdvisoryVDB Entry
https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018	Issue TrackingVendor Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.ap
https://security.netapp.com/advisory/ntap-20181014-0001/	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Track CVE-2018-12538 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-46604Apache ActiveMQ OpenWire deserialization remote code executionThe Java OpenWire protocol marshaller in Apache ActiveMQ deserializes untrusted data, letting an attacker manipulate serialized class types so the br…KEVEPSS 100%analysed27 Oct 2023 9.8CVE-2016-3427Oracle Java SE JMX Improper Access Control VulnerabilityCVE-2016-3427 is an unspecified vulnerability in Oracle Java SE 6u113, 7u99, 8u77, Java SE Embedded 8u77, and JRockit R28.3.9, reached through vector…KEVEPSS 92%analysed21 Apr 2016 7.8CVE-2019-13272Linux kernel ptrace credential mishandling allows local root escalationThe Linux kernel before 5.1.17 mishandles credential recording in ptrace_link (kernel/ptrace.c) when a process creates a ptrace relationship, and als…KEVEPSS 52%analysed17 Jul 2019 7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10 Oct 2023 9.8CVE-2022-32207Haxx curl incorrect default permissions vulnerabilityWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from …EPSS 7.7%7 Jul 2022 9.8CVE-2021-43527Mozilla nss out-of-bounds write vulnerabilityNSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signa…EPSS 18%8 Dec 2021 9.8CVE-2021-3711OpenSSL SM2 decryption buffer overflowOpenSSL's SM2 decryption code miscalculates the output buffer size needed by EVP_PKEY_decrypt(), so the first sizing call can return a value smaller …EPSS 88%analysed24 Aug 2021 9.8CVE-2021-33574Gnu glibc use after free vulnerabilityThe mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes ob…EPSS 2.9%25 May 2021

Source: NIST National Vulnerability Database (record CVE-2018-12538), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.