Weaknesses of type CWE-384

249 results

Fixação de Sessão

É quando um atacante consegue forçar um usuário a usar um ID de sessão conhecido por ele, geralmente reutilizando a mesma sessão antes e depois do login. Depois que a vítima se autentica com aquele ID fixo, o atacante usa o mesmo ID para acessar a conta sem precisar da senha.

Example

Um site gera um cookie de sessão antes do login. O atacante envia um link com esse ID de sessão para a vítima (ex: www.site.com?jsessionid=ATACANTE123), a vítima clica e faz login normalmente, mas o atacante já tem acesso à mesma sessão autenticada porque o servidor nunca regenerou o ID após a autenticação.

How to mitigate

Regenere o ID de sessão imediatamente após um login bem-sucedido. Valide que o IP ou outros atributos da sessão não mudaram drasticamente entre requisições. Use flags Secure, HttpOnly e SameSite nos cookies de sessão para reduzir vetores de ataque.

CVE-2022-40293CRITICALSession fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.7%CVE-2023-42322CRITICALInsecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.EPSS 0.6%CVE-2024-10158MEDIUMPHPGurukul Boat Booking System session_start session fixiationEPSS 0.6%CVE-2022-43687MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authenticatEPSS 0.6%CVE-2022-44788MEDIUMAn issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that isEPSS 0.6%CVE-2023-52268CRITICALThe End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session tEPSS 0.6%CVE-2014-125048MEDIUMkassi xingwall oauth.js session fixiationEPSS 0.6%CVE-2024-0351LOWSourceCodester Engineers Online Portal session fixiationEPSS 0.6%CVE-2024-25977HIGHSession FixationEPSS 0.6%CVE-2024-2639MEDIUMBdtask Wholesale Inventory Management System session fixiationEPSS 0.5%CVE-2018-16463—A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access tEPSS 0.5%CVE-2023-27490HIGHMissing proper state, nonce and PKCE checks for OAuth authentication in next-authEPSS 0.5%CVE-2022-24745MEDIUMGuest session is shared between customers in shopwareEPSS 0.5%CVE-2022-43398HIGHA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 0.5%CVE-2026-41613HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-31221MEDIUMClients removed during unpairing process may regain access if Sunshine was not restartedEPSS 0.5%CVE-2024-57052CRITICALAn issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php fileEPSS 0.5%CVE-2023-3394MEDIUMSession Fixation in fossbilling/fossbillingEPSS 0.5%CVE-2025-27661CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.EPSS 0.5%CVE-2025-45949CRITICALA critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-passwoEPSS 0.5%