CVE-2025-22387

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.

Se descubrió un problema en Optimizely Configured Commerce antes de la versión 5.2.2408. Existe un problema de gravedad media en las solicitudes de recursos en las que el token de sesión se envía como un parámetro de URL. Esto expone información sobre la sesión autenticada, que se puede aprovechar para el secuestro de sesiones.