BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Link | Tags |
---|---|
https://neetech18.blogspot.com/2019/03/session-fixation-smart-vista-svfe-2.html | third party advisory exploit |