A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges.