Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
CVSS Information
N/A
Vulnerability Type
J2EE误配置：会话ID长度不充分
Vulnerability Title
Eclipse Jetty 授权问题漏洞
Vulnerability Description
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty 9.4.0版本至9.4.8版本中存在安全漏洞。攻击者可利用该漏洞访问/劫持其他HttpSessions并删除不匹配的HttpSessions。
CVSS Information
N/A
Vulnerability Type
N/A