Imp Webmail session hijacking vulnerability

From LinuxSecurity.com: “Joao Pedro reports that “It’s possible to hijack an imp/horde session using a cross-site script attack, quite similar to the one explored by Marc Slemko in his “Microsoft Passport to Trouble” paper.””