Description
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-commons-daemon-eap6 | 1:1.0.15-4.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | apache-commons-pool-eap6 | 1.6-6.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.6.6-20.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | atinject | 1-9.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | atinject-eap6 | 1-3.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-4.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | cxf-xjc-dv +3 | 2.6.0-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | dom4j +1 | 1.6.1-19.redhat_5.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | ecj3 | 1:3.7.2-6.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-javamail | 1.4.5-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-jaxb +1 | 2.2.5-14.redhat_5.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-jsf | 2.1.19-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-jsf12 | 1.2_15-12_b01_redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | guava +1 | 13.0.1-1.redhat_1.ep6.el5.1 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | h2database | 1.3.168-3_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | hibernate4 +4 | 4.2.0-3.Final_redhat_1.ep6.el6 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | hibernate4-validator | 4.3.1-1.Final_redhat_1.1.ep6.el5.5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | hornetq +2 | 2.3.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | httpcomponents +1 | 6-7.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | httpcore +4 | 4.2.1-7.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | httpd +2 | 2.2.22-18.ep6.el6 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.6-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | ironjacamar | 1.0.17-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jacorb-jboss | 2.3.2-11.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jansi | 1.9-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jaxbintros | 1.0.2-14.GA_redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-deployment | 1.3.0-2.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-framework-core | 2.1.0-2.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-metadata | 2.2.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-resolver | 3.0.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-spi | 3.2.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-vfs | 1.2.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.3-1_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-as-console | 1.5.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-as-ee +59 | 7.2.0-8.Final_redhat_8.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-common-beans +2 | 1.1.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-dmr | 1.1.6-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.21-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jaxrpc-api_1.1_spec | 1.0.1-4.Final_redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jaxrs-api_1.1_spec | 1.0.1-7.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jms-api_1.1_spec +1 | 1.0.1-6.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.19.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.4.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.3.16-.GA.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.0.8-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.2.0-2.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-msc | 1.0.4-1.GA_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.6-2.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.2.16-1.GA_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.5-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-servlet-api_3.0_spec | 1.0.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-threads +1 | 2.1.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.2.0-7.Final_redhat_7.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.4-3.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossweb | 7.2.0-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-api | 1.0.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-common | 2.1.1-1.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.1.3-1.Final_redhat_3.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-native | 4.1.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-spi | 2.1.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jcip-annotations | 1.0-3.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jcip-annotations-eap6 | 1.0-3.1.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.7-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | joda-time | 1.6.2-5.redhat_4.ep6.el5.5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jul-to-slf4j-stub | 1.0.1-1.Final_redhat_1.1.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_cluster +1 | 1.2.4-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_cluster-native | 1.2.4-1.Final.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_jk +1 | 1.2.37-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_ssl | 1:2.2.22-18.ep6.el6 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | netty | 3.6.2-1_redhat_1.1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | objectweb-asm-eap6 | 3.3.1-6.2.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | opensaml | 2.5.1-1.redhat_1.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | openws | 1.4.2-9_redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | org.osgi +2 | 4.2.0-9.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.17-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.6-3.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | relaxngDatatype +1 | 2011.1-4.redhat_6.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.6-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | slf4j +1 | 1.7.2-10.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | slf4j-jboss-logmanager | 1.0.2-1.GA_redhat_1.3.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | sun-ws-metadata-2.0-api | 1.0.MR1-12_MR1_redhat_3.ep6.el5.5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | tomcat-native +1 | 1.1.27-4.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | velocity-eap6 | 1.7-2.1.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | weld-cdi-1.0-api | 1.0-8.SP4_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.13-1.Final_redhat_1.ep6.el5.1 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | woodstox-core | 4.2.0-7.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | woodstox-core-asl | 4.2.0-7.redhat_2.ep6.el6 | RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | woodstox-stax2-api | 3.1.1-7.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | wsdl4j-eap6 | 1.6.2-12.3.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.9-2.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xerces-j2-eap6 | 2.9.1-14_redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xml-commons-resolver-eap6 | 1.2-10.redhat_3.ep6.el5.4 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.3-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xmltooling | 1.3.2-10.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
Advisories 2
- RHSA-2013:0839 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0834 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2013:0839 vendor-advisory
- RHSA-2013:0833 vendor-advisory
- RHSA-2013:1437 vendor-advisory
- http://ocpsoft.org/support/topic/session-id-is-appended-as-url-path-parameter-in-very-first-request/
- https://issues.jboss.org/browse/JBWEB-249
- RHSA-2013:0834 vendor-advisory