search

cx-justin-ruth / CxFlowGithub

0 stars 0 forks source link

CX Session_Fixation @ root/logout.jsp [master] #34

Open cx-justin-ruth opened 2 years ago

cx-justin-ruth commented 2 years ago

Session_Fixation issue exists @ root/logout.jsp in branch master

Method session.setAttribute at line 3 of root\logout.jsp performs user authentication without terminating existing sessions. This may enable Session Fixation.

Severity: Medium

CWE:384

Vulnerability details and guidance

Checkmarx

Lines: 3 4 5

Code (Line #3):

session.setAttribute("username", null);

Code (Line #4):

session.setAttribute("usertype", null);

Code (Line #5):

session.setAttribute("userid", null);