Skip to content
CVE PROGRAM SOURCE RECORD2.9 Low

CVE-2021-34428

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Eclipse Foundation Eclipse Jetty

  • 9.0.0 to < unspecifiedaffected
  • unspecified to ≤ 9.4.40affected
  • 10.0.0 to < unspecifiedaffected
  • unspecified to ≤ 10.0.2affected
  • 11.0.0 to < unspecifiedaffected
  • unspecified to ≤ 11.0.2affected

References