Session token sent in url

Description

During the scan, Kayran managed to find that a Session token is being sent in the URL.
Sensitive information within URLs could be logged in various locations, including the user’s browser, the web server, and any (forward or reverse) proxy servers between the two endpoints.

This vulnerability could allow attackers to steal the Session token. That, will allow them to redirect users to malicious and external websites which could lead to creating a wide array of attack vectors.

Severity/Score

CVSS Version 3.x – 5.3 Medium

Recommendation

Applications should use an alternative much safer mechanism for transferring session tokens. Mechanisms such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

References

https://cwe.mitre.org/data/definitions/200.html

< Return to all Vulnerabilities

Exposing the GIT

Let’s start with defining the meaning of GIT. GIT – is an open-source system which we use as a tool to store data and information

Read More »

What is a CWE ?

Similar to the article written on CVEs, in this article we will answer the questions :What is CWE ? and, what is the difference between

Read More »