Skip to content

Codecrew / Moya

Go to a project
Merge Request !216 opened by

Hostname checking in httpsession

Credentials are checked per session and hostname is checked per request. This can be abused to escalate privileges from one event to another by copying JSESSIONID-cookie from hostname to another

Edited
Request to merge tuomari:hostnamefix into master

Merged

  • The changes were merged into master.
  • The source branch has been removed.
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!