CVE-2012-4529

The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.

• http://ocpsoft.org/support/topic/session-id-is-appended-as-url-path-parameter-in-very-first-request/
• http://rhn.redhat.com/errata/RHSA-2013-0833.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0834.html
• http://rhn.redhat.com/errata/RHSA-2013-0839.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1437.htmlVendor Advisory
• https://issues.jboss.org/browse/JBWEB-249
• http://ocpsoft.org/support/topic/session-id-is-appended-as-url-path-parameter-in-very-first-request/
• http://rhn.redhat.com/errata/RHSA-2013-0833.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0834.html
• http://rhn.redhat.com/errata/RHSA-2013-0839.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1437.htmlVendor Advisory
• https://issues.jboss.org/browse/JBWEB-249

Published

Oct 28, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4523radsecproxy before 1.6.1 does not properly verify certificat…
• CVE-2012-4524xlockmore before 5.43 'dclock' security bypass vulnerability7.5
• CVE-2012-4525piwigo has XSS in password.php6.1
• CVE-2012-4526piwigo has XSS in password.php (incomplete fix for CVE-2012-…6.1
• CVE-2012-4527Stack-based buffer overflow in mcrypt 2.6.8 and earlier allo…
• CVE-2012-4528The mod_security2 module before 2.7.0 for the Apache HTTP Se…
• CVE-2012-4530The load_script function in fs/binfmt_script.c in the Linux …
• CVE-2012-4531Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x be…
• CVE-2012-4532Cross-site scripting (XSS) vulnerability in modules/mod_lang…
• CVE-2012-4533Cross-site scripting (XSS) vulnerability in the "extra" deta…
• CVE-2012-4534org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat…
• CVE-2012-4535Xen 3.4 through 4.2, and possibly earlier versions, allows l…