This website uses cookies. By continuing to browse or login to this website, you consent to the use of cookies. Learn more.
OK
murali.nadiger
Absent Member.
Absent Member.
‎2015-02-24 06:04
4828 views

Fortify flagging Session Fixation vulnerability, may be a flase positive?

Hi All,

In my Java web application SCA is flagging Session Fixation issue in login page however I doubt it might be a flase positive. Its quite old application developed few years back. "J_security_check" is used for handling login mechanism which uses "org.jboss.security.auth.spi.DatabaseServerLoginModule".

Application doesn't show a session id/jsession id in the url and it interacts through secured channel, I mean "https". I suspect this is false positive the reason is as part of the fortify analysis jboss code isn't configured to analyse and the analysis happens on local/development environment where interation doesn't happen on secured channel, I mean to say its "http" not "https".

Could you please guide is this false positive or Am I missing anything here??

Thanks in advance.

Regards,

Murali

0 Likes
Reply
Report Inappropriate Content
0 Replies
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.