Description
During the scan, Kayran managed to find that a Session token is being sent in the URL.
Sensitive information within URLs could be logged in various locations, including the user’s browser, the web server, and any (forward or reverse) proxy servers between the two endpoints.
This vulnerability could allow attackers to steal the Session token. That, will allow them to redirect users to malicious and external websites which could lead to creating a wide array of attack vectors.
Severity/Score
CVSS Version 3.x – 5.3 Medium
Recommendation
Applications should use an alternative much safer mechanism for transferring session tokens. Mechanisms such as HTTP cookies or hidden fields in forms that are submitted using the POST method.
