Information Disclosure

2023-04-1811:50:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

information disclosure

software vulnerability

session hijacking

EPSS

0.001

Percentile

22.8%

JSON

Spring Session Core is vulnerable to Information Disclosure. The vulnerability exists in the resolveSessionIds function in HeaderHttpSessionIdResolver.java because the session id is logged which allows an attacker with access to the application logs and perform session hijacking.