Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
intelliants subrion 4.2.1