   protected OHttpSessionManager() {
     expirationTime = OGlobalConfiguration.NETWORK_HTTP_SESSION_EXPIRE_TIMEOUT.getValueAsInteger() * 1000;

     Orient.instance().scheduleTask(new TimerTask() {
       @Override
       public void run() {
         final int expired = checkSessionsValidity();
         if (expired > 0)
           OLogManager.instance().debug(this, "Removed %d session because expired", expired);
       }
     }, expirationTime, expirationTime);
   }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.