CVE-2021-34428: Insufficient Session Expiration

June 22, 2021 (updated November 7, 2023)

If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

References

nvd.nist.gov/vuln/detail/CVE-2021-34428

Code Behaviors & Features

Detect and mitigate CVE-2021-34428 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →