Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2022-36179CRITICALFusiondirectory 1.3 suffers from Improper Session Handling.EPSS 1.0%CVE-2026-82310HIGHApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessEPSS 1.0%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2019-5638HIGHRapid7 Nexpose Insufficient Session ManagementEPSS 1.0%CVE-2022-24042—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 1.0%CVE-2021-34428LOWFor Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thEPSS 1.0%CVE-2024-45033HIGHApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliEPSS 1.0%CVE-2026-82311CRITICALApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseEPSS 0.9%CVE-2022-3362MEDIUMInsufficient Session Expiration in ikus060/rdiffwebEPSS 0.9%CVE-2024-42447CRITICALApache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowEPSS 0.9%CVE-2017-14007—An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is availablEPSS 0.9%CVE-2017-3215—The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with aEPSS 0.9%CVE-2023-31140MEDIUMOpenProject user sessions not terminated after activation of 2FAEPSS 0.9%CVE-2023-1854MEDIUMSourceCodester Online Graduate Tracer System session expirationEPSS 0.9%CVE-2020-1776LOWInvalidating or changing user does not invalidate sessionEPSS 0.9%CVE-2022-2306HIGHInsufficient Session Expiration in heroiclabs/nakamaEPSS 0.9%CVE-2023-36252—An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial ofEPSS 0.9%CVE-2022-33137—A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All veEPSS 0.8%CVE-2021-37693MEDIUMRe-use of email tokens in DiscourseEPSS 0.8%CVE-2020-1724MEDIUMA flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal inEPSS 0.8%