cve.bz

CVE-2021-34428

3.5 lowEPSS 1.0%

Low (3.5). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-server 10.0.3, 11.0.3, 9.4.41.

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Severity

CVSS 3.1

3.5 low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE
CWE-613
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m6cp-vxjx-65j6Mavenorg.eclipse.jetty:jetty-server<9.4.419.4.41
GHSA-m6cp-vxjx-65j6Mavenorg.eclipse.jetty:jetty-server>=10.0.0 <10.0.310.0.3
GHSA-m6cp-vxjx-65j6Mavenorg.eclipse.jetty:jetty-server>=11.0.0 <11.0.311.0.3

References

Check your stackJSON