Fallos del tipo CWE-384

253 resultados

Fixação de sessão

Ocorre quando a aplicação não regenera o ID da sessão após autenticação bem-sucedida, permitindo que um atacante force um usuário a usar um ID de sessão pré-conhecido. Depois que a vítima se autentica nessa sessão comprometida, o atacante consegue acessar a conta usando o ID que já controla.

Ejemplo

Um atacante envia ao usuário um link com um ID de sessão fixo (ex: PHPSESSID=abc123). A vítima clica, faz login normalmente, mas o servidor nunca muda o ID. Agora o atacante usa a mesma sessão para acessar a conta autenticada, roubando dados ou fazendo transações.

Cómo mitigar

Regenere o ID da sessão imediatamente após login bem-sucedido, descarte o ID antigo, e use um algoritmo criptograficamente forte para gerar novos IDs. Além disso, valide o IP/User-Agent da sessão e implemente timeout de inatividade.

CVE-2024-56733MEDIUMPassword Pusher Allows Session Token Interception Leading to Potential HijackingEPSS 0.2%CVE-2026-35095MEDIUMSession fixation in KTM System e-BOKEPSS 0.2%CVE-2024-49709LOWXSS in iKSORISEPSS 0.2%CVE-2025-0251LOWHCL IEM is affected by a concurrent login vulnerabilityEPSS 0.2%CVE-2025-7015MEDIUMSession Hijacking in Akinsoft's QR MenuEPSS 0.2%CVE-2025-0253LOWHCL IEM is affected by a cookie attribute not set vulnerabilityEPSS 0.2%CVE-2021-3740MEDIUMSession Fixation in chatwoot/chatwootEPSS 0.2%CVE-2026-76196HIGHPhotoshop Mobile | Session Fixation (CWE-384)EPSS 0.2%CVE-2025-70973MEDIUMScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not EPSS 0.2%CVE-2023-50920MEDIUMAn issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers EPSS 0.2%CVE-2025-22216MEDIUMCVE-2025-22216 UAA Missing Zone ValidationEPSS 0.2%CVE-2025-36117MEDIUMIBM Db2 Mirror for i session fixationEPSS 0.2%CVE-2026-34454LOWOAuth2 Proxy: Session cookie not cleared when rendering sign-in pageEPSS 0.2%CVE-2026-16089MEDIUMKeycloak-services: keycloak-services: authorization codes can be retargeted to another client sessionEPSS 0.2%CVE-2023-21238—In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local informEPSS 0.2%CVE-2025-56400HIGHCross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya SmarEPSS 0.2%CVE-2026-59883MEDIUMGuzzle: Cookie Disclosure and Injection via IP-Address DomainsEPSS 0.2%CVE-2025-43516LOWA session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS TahoeEPSS 0.2%CVE-2025-56746LOWCreativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation EPSS 0.2%CVE-2025-68139MEDIUMIn EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processingEPSS 0.2%