CVE-2004-1478: Hitachi Cosminexus Enterprise

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session.

Affected products

• Hitachi Cosminexus Enterprise: version 01_01_1 only; version 01_02_2 only
• Hitachi Cosminexus Server: version web_01-01_1 only; version web_01-01_2 only
• Macromedia ColdFusion: version 6.0 only; version 6.1 only
• Macromedia Jrun: version 3.0 only; version 3.1 only; version 4.0 only

Published 2004-12-31. Last modified 2026-06-16.