CVE-2014-0999

Published: Jun 2, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.

Affected (1)

Products: Sendio: Sendio

Sendio

1 product

Sendio

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sendio Sendio	Up to 7.2.3

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2015/May/95

Source: cve@mitre.org

Exploit

http://www.exploit-db.com/exploits/37114

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/535592/100/0/threaded

Source: cve@mitre.org

http://www.sendio.com/software-release-history/

Source: cve@mitre.org

Vendor Advisory

http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html