PT-2013-1681 · Red Hat+1 · Red Hat Jboss Web+1

Publicado 2013-10-28 · Atualizado 2013-10-30 · CVE-2012-4529

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Web versions 7.1.x and earlier

Description The issue concerns the org.apache.catalina.connector.Response.encodeURL method. When the tracking mode is set to COOKIE, it sends the jsessionid in the URL of the first response of a session. This allows remote attackers to obtain the session id either via a man-in-the-middle attack or by reading a log.

Recommendations For Red Hat JBoss Web versions 7.1.x and earlier, consider configuring the tracking mode to avoid sending the jsessionid in the URL, or apply alternative security measures to protect session ids from being obtained by unauthorized parties. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2012-4529

RHSA-2013:0834

RHSA-2013:0839

Produtos afetados

Apache Catalina

Red Hat Jboss Web

Referências · 8

• http://ocpsoft.org/support/topic/session-id-is-appended-as-url-path-parameter-in-very-first-request · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4529 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4529 · Nota
• https://issues.jboss.org/browse/JBWEB-249 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0839.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-1437.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0833.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0834.html · Aviso do Fabricante