JSessionID Visible in Appian Cloud Portal creating security concern in Pen Testing

I suggest to contact Appian do discuss that. From the past, I remember such conversations and, at the end of the day, it was no issue.

Thanks Stefan Helzle , already planned to do that

Also if anything comes up to you update would be very helpful.

• The browser won’t attach this cookie in the HTTP request
• The HTTPS request will be encrypted so cookies will be safely sent
• When sent over HTTPS, all data will be encrypted from the browser and sent to the network. The attacker won’t be able to get the raw data

Are you sure there is a security problem? Does the test show a specific problem or does it just say that maybe there is a problem?

I did some tests in the past, and I think it's not possible for you to get anywhere with that JSESSIONID.

In any case, contact Appian if you prefer to be sure about it