Vulnetix
Try Vulnetix Request Demo
CVE-2012-4529 PUBLISHED CVSS 4.300000190734863 MEDIUM

The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.

EPSS 0.56% · 68.2th percentile

Risk Scores

CVSS v2.0
4.300000190734863
EPSS Score
0.56%
68.2th percentile

Affected Products

VendorProductVersions
redhatjboss_community_application_server7.1.0, 0, 5.0.0
redhatjboss_enterprise_application_platform6.0.0
n/an/an/a

Timeline

References

Open in Interactive Console →