Fallos del tipo CWE-613

475 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2026-92378MEDIUMuniFLOW Online Legacy UI Previous login session retained when entering Reduced Function LoginEPSS 0.2%CVE-2025-43819MEDIUMA Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4EPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%CVE-2025-66483MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2025-4407MEDIUMApplication does not invalidate session after password resetEPSS 0.2%CVE-2024-41985LOWA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.2%CVE-2026-80174MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient SessEPSS 0.2%CVE-2025-36063MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2022-38707MEDIUMIBM Cognos Command Center information disclosureEPSS 0.2%CVE-2025-53642MEDIUMhaxcms-nodejs and haxcms-php Improperly Terminate SessionsEPSS 0.2%CVE-2025-65430MEDIUMAn issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user whEPSS 0.2%CVE-2022-34392MEDIUM SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-adminEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%CVE-2026-6515MEDIUMInsufficient Session Expiration in GitLabEPSS 0.2%CVE-2026-66376MEDIUMDeleted users may temporarily retain access to JFrog ArtifactoryEPSS 0.2%CVE-2025-27898MEDIUMMultiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsEPSS 0.2%CVE-2026-24669HIGHOpen eClass Insecure Password Reset Token Reuse Enables Account TakeoverEPSS 0.2%CVE-2023-40732LOWA vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not inEPSS 0.2%CVE-2026-16970MEDIUMDFIR-IRIS Insufficient Logout ImplementationEPSS 0.2%CVE-2024-40683MEDIUMIBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password changeEPSS 0.2%