CVE-2012-4529

Web: jsessionid exposed via encoded url when using cookie based session tracking

Published Oct 28, 2013 CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Description
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2012-4457 The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 8:42 PM
Reserved
Aug 21, 2012, 12:00 AM
Status
Modified
Published
Oct 28, 2013, 9:55 PM
Modified
Jun 16, 2026, 11:45 PM
Severity
Low
Public date
Oct 10, 2012, 12:00 AM