Session Fixation

org.opencastproject, base is vulnerable to session fixation. The vulnerability is due to failure to regenerate the session ID after authentication when a client-supplied JSESSIONID is accepted through the URL, which allows an attacker to hijack a victim’s authenticated session and potentially gai...