Fallos del tipo CWE-613

549 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2025-59841CRITICALFlagForgeCTF's Improper Session Handling Allows Access After LogoutEPSS 0.4%CVE-2026-92616HIGHFileRise < 3.28.0 Privilege Escalation via WebDAV Session InheritanceEPSS 0.4%CVE-2026-79624CRITICALApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session RevocationEPSS 0.4%CVE-2025-28132MEDIUMA session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leadiEPSS 0.4%CVE-2025-65883HIGHA vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local network attacker to achievEPSS 0.4%CVE-2024-34092MEDIUMAn issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing sessioEPSS 0.4%CVE-2026-118665HIGHGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsEPSS 0.4%CVE-2025-46336MEDIUMRack session gets restored after deletionEPSS 0.4%CVE-2024-33507HIGHAn insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 thrEPSS 0.4%CVE-2024-25051MEDIUMIBM Jazz Reporting Service insufficient session expirationEPSS 0.4%CVE-2026-79313CRITICALwebpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expirEPSS 0.4%CVE-2026-48726MEDIUMApache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout pathEPSS 0.4%CVE-2026-26290MEDIUMEV Energy ev.energy Insufficient Session ExpirationEPSS 0.4%CVE-2025-56643CRITICALRequarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokenEPSS 0.4%CVE-2025-31952HIGHHCL iAutomate is affected by an insufficient session expirationEPSS 0.4%CVE-2023-50936MEDIUMIBM PowerSC session fixationEPSS 0.4%CVE-2025-50486HIGHImproper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execEPSS 0.4%CVE-2025-50485HIGHImproper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to exEPSS 0.4%CVE-2023-45187MEDIUMIBM Engineering Lifecycle Optimization - Publishing session fixationEPSS 0.4%CVE-2025-71335HIGHFlowise - Session Invalidation Failure After Password ChangeEPSS 0.4%