Weaknesses of type CWE-384

274 results

Fixação de Sessão

É quando um atacante consegue forçar um usuário a usar um ID de sessão conhecido por ele, geralmente reutilizando a mesma sessão antes e depois do login. Depois que a vítima se autentica com aquele ID fixo, o atacante usa o mesmo ID para acessar a conta sem precisar da senha.

Example

Um site gera um cookie de sessão antes do login. O atacante envia um link com esse ID de sessão para a vítima (ex: www.site.com?jsessionid=ATACANTE123), a vítima clica e faz login normalmente, mas o atacante já tem acesso à mesma sessão autenticada porque o servidor nunca regenerou o ID após a autenticação.

How to mitigate

Regenere o ID de sessão imediatamente após um login bem-sucedido. Valide que o IP ou outros atributos da sessão não mudaram drasticamente entre requisições. Use flags Secure, HttpOnly e SameSite nos cookies de sessão para reduzir vetores de ataque.

CVE-2023-28316CRITICALA security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not iEPSS 0.7%CVE-2023-30056HIGHA session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cEPSS 0.7%CVE-2021-29368HIGHSession fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gaiEPSS 0.7%CVE-2024-38513CRITICALFiber Session Middleware Token Injection VulnerabilityEPSS 0.7%CVE-2023-46733MEDIUMSymfony possible session fixation vulnerabilityEPSS 0.7%CVE-2026-95828MEDIUMMstfakts College-Management-System Authentication server.php session_start session fixiationEPSS 0.7%CVE-2024-10158MEDIUMPHPGurukul Boat Booking System session_start session fixiationEPSS 0.7%CVE-2022-44788MEDIUMAn issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that isEPSS 0.7%CVE-2023-2105HIGHSession Fixation in alextselegidis/easyappointmentsEPSS 0.7%CVE-2024-23590CRITICALApache Kylin: Session fixation in web interfaceEPSS 0.7%CVE-2014-125048MEDIUMkassi xingwall oauth.js session fixiationEPSS 0.7%CVE-2023-52268CRITICALThe End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session tEPSS 0.6%CVE-2026-75171CRITICALAn issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.EPSS 0.6%CVE-2022-43398HIGHA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 0.6%CVE-2024-0351LOWSourceCodester Engineers Online Portal session fixiationEPSS 0.6%CVE-2024-25977HIGHSession FixationEPSS 0.6%CVE-2023-0897HIGHSession FIxation in Sielco PolyEco1000EPSS 0.6%CVE-2024-30262MEDIUMContao's remember-me tokens will not be cleared after a password changeEPSS 0.6%CVE-2026-77614HIGHOpencast: Session fixation in login enables account takeover via crafted linkEPSS 0.5%CVE-2018-16463—A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access tEPSS 0.5%