CVEvulnerability
CVE-2014-0999
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-06-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.
Affected configurations
• sendio sendio (<= 7.2.3)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html Exploit
- http://seclists.org/fulldisclosure/2015/May/95 Exploit
- http://www.exploit-db.com/exploits/37114 Exploit
- http://www.securityfocus.com/archive/1/535592/100/0/threaded www.securityfocus.com
- http://www.sendio.com/software-release-history/ Vendor Advisory
- http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html Exploit
- http://seclists.org/fulldisclosure/2015/May/95 Exploit
- http://www.exploit-db.com/exploits/37114 Exploit
- http://www.securityfocus.com/archive/1/535592/100/0/threaded www.securityfocus.com
- http://www.sendio.com/software-release-history/ Vendor Advisory