Fallos del tipo CWE-613

547 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2026-82310HIGHApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessEPSS 1.0%CVE-2022-36179CRITICALFusiondirectory 1.3 suffers from Improper Session Handling.EPSS 1.0%CVE-2024-45033HIGHApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliEPSS 1.0%CVE-2022-24042—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 1.0%CVE-2026-82311CRITICALApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseEPSS 1.0%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2021-34428LOWFor Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thEPSS 1.0%CVE-2022-3362MEDIUMInsufficient Session Expiration in ikus060/rdiffwebEPSS 1.0%CVE-2024-42447CRITICALApache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowEPSS 0.9%CVE-2020-1776LOWInvalidating or changing user does not invalidate sessionEPSS 0.9%CVE-2026-86533CRITICALRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEPSS 0.9%CVE-2017-14007—An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is availablEPSS 0.9%CVE-2017-3215—The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with aEPSS 0.9%CVE-2023-31140MEDIUMOpenProject user sessions not terminated after activation of 2FAEPSS 0.9%CVE-2023-1854MEDIUMSourceCodester Online Graduate Tracer System session expirationEPSS 0.9%CVE-2022-2306HIGHInsufficient Session Expiration in heroiclabs/nakamaEPSS 0.9%CVE-2023-36252—An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial ofEPSS 0.9%CVE-2026-55250HIGHMaravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged CachesEPSS 0.9%CVE-2022-33137—A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All veEPSS 0.9%CVE-2019-5638HIGHRapid7 Nexpose Insufficient Session ManagementEPSS 0.8%