OTRSSession security risk ?

Arr · Post by **Arr** » 30 Mar 2011, 11:20

Hello,

when i set manually a known session id into the url field of my browser, i can furtherway substitute and act as the user who owns the session generally without any login+password procedure

is it a little too big security risk ?

asks
Arndt

Alexander Halle · Post by **Alexander Halle** » 30 Mar 2011, 11:28

(moved from the developer forum to the appropriate forum)

jojo · Post by **jojo** » 30 Mar 2011, 15:18

it seems that you switched of the IP Check for the session handling...

Znuny Open Source Ticketsystem

OTRSSession security risk ?

OTRSSession security risk ?

moved topic

Re: OTRSSession security risk ?