Weaknesses of type CWE-613

474 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2022-2713HIGHInsufficient Session Expiration in cockpit-hq/cockpitEPSS 1.2%CVE-2022-23063HIGHShopizer - Insufficient Session ExpirationEPSS 1.2%CVE-2022-31050MEDIUMInsufficient Session Expiration in TYPO3 Admin ToolEPSS 1.2%CVE-2022-2064CRITICALInsufficient Session Expiration in nocodb/nocodbEPSS 1.2%CVE-2024-22543MEDIUMAn issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET reEPSS 1.2%CVE-2023-31065CRITICALApache InLong: Insufficient Session Expiration in InLongEPSS 1.2%CVE-2021-36330HIGHDell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attaEPSS 1.2%CVE-2020-1762HIGHAn insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a reEPSS 1.2%CVE-2024-50562MEDIUMAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and belEPSS 1.1%CVE-2021-25979CRITICALApostrophe - Insufficient Session ExpirationEPSS 1.1%CVE-2025-24859LOWApache Roller: Insufficient Session Expiration on Password ChangeEPSS 1.1%CVE-2021-42545HIGHInsufficient Session Expiration in TopEaseEPSS 1.1%CVE-2020-15269HIGHExpired token reuse in SpreeEPSS 1.1%CVE-2021-25966HIGHOrchard Core CMS - Improper Session Termination after Password ChangeEPSS 1.1%CVE-2021-35034HIGHAn insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access thEPSS 1.0%CVE-2022-22113HIGHDayByDay CRM - Insufficient Session Expiration after Password ChangeEPSS 1.0%CVE-2023-24426HIGHJenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.EPSS 1.0%CVE-2022-0991HIGHInsufficient Session Expiration in admidio/admidioEPSS 1.0%CVE-2022-31145MEDIUMInsufficient AccessToken Expiration Check in FlyteAdminEPSS 1.0%CVE-2024-13996CRITICALNagios XI < 2024R1.1.3 Session Not Invalidated After Password ChangeEPSS 1.0%