CVE-2014-0999 | BDVDB-2026-69690 Detail

Description#

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://seclists.org/fulldisclosure/2015/May/95
http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html
http://www.securityfocus.com/archive/1/535592/100/0/threaded
http://www.sendio.com/software-release-history/
http://www.exploit-db.com/exploits/37114

Exploit#

http://www.exploit-db.com/exploits/37114

History#

Version 12015-06-02Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.