The was help document defines the session timeout:
The session timeout specifies how long it will remain unused until the session is no longer valid. Specifies that the setting timeout or no timeout. Specifies a value that is greater than or equal to 2 in minutes. The values specified in the WEB module deployment descriptor file take precedence over the administrative console settings. However, if the session timeout is not specified in the Web module deployment descriptor, the value of this setting is used as the default value. Note that in order to maintain performance, the expiration timer is not accurate to seconds. When the write frequency is based on time, make sure that the value is at least twice times the write time interval.
Conclusion: If the session timeout of Session-timeout and was is set at the same time in Web.xml, the former shall prevail