Description

The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.

Remediation

References

CVE-2012-4529

Related Vulnerabilities

OpenSSL Other Vulnerability (CVE-2002-0656)

WordPress Plugin Word of the day Arbitrary File Upload (1.0)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-4698)

WordPress Plugin WP User Switch Security Bypass (1.0.2)

WordPress Plugin Lazyest Gallery EXIF Code Cross-Site Scripting (1.1.20)

Severity

Medium

Classification

CVE-2012-4529

Tags

Missing Update Known Vulnerabilities