CVE-2021-34428: 
Java vulnerability analysis and mitigation

CVE-2021-34428 affects Eclipse Jetty versions <= 9.4.40, <= 10.0.2, and <= 11.0.2. The vulnerability was discovered in June 2021 and involves a session invalidation issue that occurs when an exception is thrown from the SessionListener#sessionDestroyed() method (GitHub Advisory).

The vulnerability occurs when an exception is thrown from the SessionListener#sessionDestroyed() method, causing the session ID to not be invalidated in the session ID manager. This specifically affects deployments with clustered sessions and multiple contexts (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 2.9 (Low) with the vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (GitHub Advisory).

When successfully exploited, this vulnerability can result in a session not being invalidated, potentially leaving an application used on a shared computer logged in. There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception (GitHub Advisory).

The vulnerability requires physical access and has high attack complexity. There is no known path for an attacker to induce the exception, making exploitation dependent on application behavior rather than direct attack (GitHub Advisory).

The issue has been patched in Jetty versions 9.4.41, 10.0.3, and 11.0.3. As a workaround, applications should catch all Throwables within their SessionListener#sessionDestroyed() implementations (GitHub Advisory).