CVE-2021-34428

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-22 · updated 2026-06-17
Weakness: CWE-613

Description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Affected products

Debian Linux: 10.0
The Eclipse Foundation Eclipse Jetty: through 9.4.40; from 10.0.0 through 10.0.2; from 11.0.0 through 11.0.2
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.70.1
NetApp E-Series Santricity Web Services: all versions
NetApp, Inc. Element Plug-in for vCenter Server: all versions
NetApp Santricity Cloud Connector: all versions
NetApp Snap Creator Framework: all versions
SnapManager for Oracle: all versions
Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
Oracle Communications Element Manager: 8.2.2
Oracle Communications Services Gatekeeper: 7.0
Oracle Communications Session Report Manager: from 8.0.0.0 through 8.2.4.0
Oracle Communications Session Route Manager: from 8.0.0 through 8.2.4.0
Oracle Corporation Oracle REST Data Services: before 21.3 — fixed in 21.3
Oracle Siebel Core - Automation: through 21.9

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle REST Data Services 21.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34428 or the next vulnerability affects your stack