Inadequate session management can allow an attacker without special access rights to determine the session ID of a user with extensive access rights. The attacker can then use this ID to access protected functions and resources of the web application, such as in the form of a session fixation attack. Here, the attacker first has the web application assign them a session ID with restricted user rights. This ID is then transmitted to a legitimate user with higher access rights (e.g. via a link in an e-mail). If the user with higher rights follows this link and authenticates themselves to the web application under the attacker's session ID, the attacker can then use the application with the full access rights of the legitimate user.