Description
JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session.
References
- jrun-jsessionid-hijack(17481) vdb-entry
- 20040923 New Macromedia Security Zone Bulletins Posted mailing-list
- 11245 vdb-entry
- VU#584958 third-party-advisory
- http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.html
- 12638 third-party-advisory