Web Application Session Manipulation Vulnerability in Apache jUDDI

CVE-2015-5241

Summary

The Apache jUDDI web application exposes a critical weakness in its session management handling. When a user logs out, the application erroneously redirects them back to the login page without ensuring prior security checks. This flaw can be exploited by malicious users to redirect users' browsers to potential phishing sites. Furthermore, user session data, including credentials and authentication tokens, are cleared before any redirection occurs, making it possible for attackers to target users during the logout process. This issue is present in specific versions of jUDDI, raising concerns over the security of user sessions.

References