Weaknesses of type CWE-384

271 results

Fixação de Sessão

É quando um atacante consegue forçar um usuário a usar um ID de sessão conhecido por ele, geralmente reutilizando a mesma sessão antes e depois do login. Depois que a vítima se autentica com aquele ID fixo, o atacante usa o mesmo ID para acessar a conta sem precisar da senha.

Example

Um site gera um cookie de sessão antes do login. O atacante envia um link com esse ID de sessão para a vítima (ex: www.site.com?jsessionid=ATACANTE123), a vítima clica e faz login normalmente, mas o atacante já tem acesso à mesma sessão autenticada porque o servidor nunca regenerou o ID após a autenticação.

How to mitigate

Regenere o ID de sessão imediatamente após um login bem-sucedido. Valide que o IP ou outros atributos da sessão não mudaram drasticamente entre requisições. Use flags Secure, HttpOnly e SameSite nos cookies de sessão para reduzir vetores de ataque.

CVE-2022-43398HIGHA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 0.5%CVE-2022-24745MEDIUMGuest session is shared between customers in shopwareEPSS 0.5%CVE-2025-45949CRITICALA critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-passwoEPSS 0.5%CVE-2026-41613HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-27661CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.EPSS 0.5%CVE-2025-53102HIGHDiscourse's WebAuthn challenge isn't cleared from user session after authenticationEPSS 0.5%CVE-2022-30769MEDIUMSession fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.EPSS 0.5%CVE-2021-32088CRITICALAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to EPSS 0.5%CVE-2026-18527CRITICALIBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].EPSS 0.5%CVE-2024-31221MEDIUMClients removed during unpairing process may regain access if Sunshine was not restartedEPSS 0.5%CVE-2020-15679HIGHAn OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN userEPSS 0.5%CVE-2023-3394MEDIUMSession Fixation in fossbilling/fossbillingEPSS 0.5%CVE-2024-57052CRITICALAn issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php fileEPSS 0.5%CVE-2024-30262MEDIUMContao's remember-me tokens will not be cleared after a password changeEPSS 0.5%CVE-2024-13967CRITICALession-Management FailureEPSS 0.5%CVE-2026-24894HIGHFrankenPHP leaks session data between requests in worker modeEPSS 0.5%CVE-2021-46279MEDIUMSession Fixation and Insufficient Session ExpirationEPSS 0.5%CVE-2023-5309MEDIUMBroken Session Management in Puppet EnterpriseEPSS 0.5%CVE-2023-53776HIGHScreen SFT DAB 1.9.3 Authentication Bypass via Session Management WeaknessEPSS 0.5%CVE-2026-33946HIGHMCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID ReplayEPSS 0.5%