Traffix SDC update for Eclipse Jetty
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-34428 |
| CWE-ID | CWE-613 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Traffix SDC Client/Desktop applications / Software for system administration |
| Vendor | F5 Networks |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Insufficient Session Expiration
EUVDB-ID: #VU55642
Risk: Low
CVSSv3.1: 3.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-34428
CWE-ID:
CWE-613 - Insufficient Session Expiration
Exploit availability: No
DescriptionThe vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to insufficient session expiration issue. If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.
MitigationInstall update from vendor's website.
Vulnerable software versionsTraffix SDC: 5.1.0 - 5.2.0
External linkshttp://support.f5.com/csp/article/K51975973
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
