Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could then be cached by a proxy and inadvertently used by a different user.
| Software | From | Fixed in |
|---|---|---|
| microsoft / site_server | 3.0 | 3.0.x |
| microsoft / commercial_internet_system | 2.0 | 2.0.x |
| microsoft / commercial_internet_system | 2.5 | 2.5.x |
| microsoft / site_server_commerce | 3.0-alpha | 3.0-alpha.x |