search

cx-justin-ruth / CxFlowGithub

0 stars 0 forks source link

CX Session_Fixation @ root/register.jsp [master] #17

Open cx-justin-ruth opened 2 years ago

cx-justin-ruth commented 2 years ago

Session_Fixation issue exists @ root/register.jsp in branch master

Method session.setAttribute at line 34 of root\register.jsp performs user authentication without terminating existing sessions. This may enable Session Fixation.

Severity: Medium

CWE:384

Vulnerability details and guidance

Checkmarx

Lines: 34 35 36

Code (Line #34):

            session.setAttribute("username", username);

Code (Line #35):

            session.setAttribute("usertype", "USER");

Code (Line #36):

            session.setAttribute("userid", userid);