CVE-2012-4529

CVE-2012-4529 describes a vulnerability in Red Hat JBoss Web 7.1.x and earlier, specifically within the org.apache.catalina.connector.Response.encodeURL method when session tracking is set to COOKIE. This flaw causes the jsessionid to be exposed in the URL of the initial session response, allowing attackers to obtain the session ID through man-in-the-middle attacks or by accessing logs. The vulnerability has a CVSS score of 4.3, indicating a medium attack complexity and potential for partial confidentiality impact, but no integrity or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.