Is JSessionID considered for Session Variable Overloading (also known as Session Puzzling)?
- A java web application is deployed in HTTPS
- An admin user logs to the application. After login, a new JSessionID is issued.
- Another non-admin user manages to get that admin user JsessionID
- Using that Jsession Id the non-admin user performs some admin function.
Can it be considered as session puzzling?