One PUT request, one poisoned session file, and the server’s yours A trivial flaw in Apache Tomcat that allows remote code ...

The researchers added that the attack is “dead simple” to execute, and requires no authentication. The only requirement is that Tomcat is using file-based session storage which, according to the ...

A successful session hijacking cannot be performed unless the hacker knows the victim’s session key or session ID. If he can steal the session cookies, he can take over the user’s session.