The vulnerability of the SessionListener#sessionDestroyed() method in Eclipse Jetty’s servers allows a hacker to exploit their privileges.

Jetty SessionListener sessionDestroyed flaw enables privilege escalation via wrong session expiration.

Reporter	Title	Published	Views	Family All 92
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is vulnerable to various attacks due to Eclipse jetty	21 Jun 202318:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator vulnerable due to Eclipse Jetty	17 Oct 202213:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	27 Mar 202608:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Command Center is affected by multiple vulnerabilities	4 May 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues	24 Jun 202216:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM InfoSphere Information Server	17 May 202302:32	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	29 Mar 202206:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Eclipse Jetty affect IBM Security Directory Integrator	15 May 202400:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Mobile Enterprise Gateway uses Eclipse Jetty with multiple known vulnerabilities	6 Jun 202218:23	–	ibm

Vulners

Node

eclipse jettyRange<9.4.41

eclipse jettyRange<10.0.3

eclipse jettyRange<11.0.3

Source	Link
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-65j6
access	www.access.redhat.com/security/cve/CVE-2021-34428
lists	www.lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5/
web	www.web.nvd.nist.gov/view/vuln/detail

18 Oct 2022 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 22.6

CVSS 32.9

EPSS0.00963