Weaknesses of type CWE-384

274 results

Fixação de Sessão

É quando um atacante consegue forçar um usuário a usar um ID de sessão conhecido por ele, geralmente reutilizando a mesma sessão antes e depois do login. Depois que a vítima se autentica com aquele ID fixo, o atacante usa o mesmo ID para acessar a conta sem precisar da senha.

Example

Um site gera um cookie de sessão antes do login. O atacante envia um link com esse ID de sessão para a vítima (ex: www.site.com?jsessionid=ATACANTE123), a vítima clica e faz login normalmente, mas o atacante já tem acesso à mesma sessão autenticada porque o servidor nunca regenerou o ID após a autenticação.

How to mitigate

Regenere o ID de sessão imediatamente após um login bem-sucedido. Valide que o IP ou outros atributos da sessão não mudaram drasticamente entre requisições. Use flags Secure, HttpOnly e SameSite nos cookies de sessão para reduzir vetores de ataque.

CVE-2020-5290MEDIUMsession fixation in rCTFEPSS 0.8%CVE-2022-40226HIGHA vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versionsEPSS 0.8%CVE-2020-6302MEDIUMSAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. AEPSS 0.8%CVE-2023-32997HIGHJenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.EPSS 0.8%CVE-2022-24895MEDIUMSymfony vulnerable to Session Fixation of CSRF tokensEPSS 0.8%CVE-2020-5205MEDIUMSession fixation attack in Pow (Hex package)EPSS 0.8%CVE-2025-63216CRITICALThe Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers EPSS 0.8%CVE-2022-43687MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authenticatEPSS 0.8%CVE-2022-44017HIGHAn issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victiEPSS 0.8%CVE-2023-29019HIGHSession fixation in fastify-passportEPSS 0.8%CVE-2022-40293CRITICALSession fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.8%CVE-2023-34656—An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackerEPSS 0.7%CVE-2026-86688HIGHSession id is not renewed on authentication in ash_authentication, allowing session fixationEPSS 0.7%CVE-2024-37829HIGHAn issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in linkEPSS 0.7%CVE-2025-63224CRITICALThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers cEPSS 0.7%CVE-2026-82355MEDIUMApache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixationEPSS 0.7%CVE-2022-2820HIGHSession Fixation in namelessmc/namelessEPSS 0.7%CVE-2023-6913HIGHSession Hijacking on Imou Life appEPSS 0.7%CVE-2023-53741MEDIUMScreen SFT DAB 1.9.3 Authentication Bypass via IP Session ManagementEPSS 0.7%CVE-2026-92414CRITICALApache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensEPSS 0.7%