Fallos del tipo CWE-613

472 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2022-31145MEDIUMInsufficient AccessToken Expiration Check in FlyteAdminEPSS 1.0%CVE-2024-13996CRITICALNagios XI < 2024R1.1.3 Session Not Invalidated After Password ChangeEPSS 1.0%CVE-2026-82310HIGHApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessEPSS 1.0%CVE-2023-23614HIGHImproper session handling of "Remember me for 7 days" functionalityEPSS 1.0%CVE-2019-5638HIGHRapid7 Nexpose Insufficient Session ManagementEPSS 1.0%CVE-2022-24042—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 1.0%CVE-2021-34428LOWFor Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thEPSS 1.0%CVE-2024-45033HIGHApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliEPSS 1.0%CVE-2026-82311CRITICALApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseEPSS 0.9%CVE-2022-36179CRITICALFusiondirectory 1.3 suffers from Improper Session Handling.EPSS 0.9%CVE-2022-3362MEDIUMInsufficient Session Expiration in ikus060/rdiffwebEPSS 0.9%CVE-2024-42447CRITICALApache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowEPSS 0.9%CVE-2023-31140MEDIUMOpenProject user sessions not terminated after activation of 2FAEPSS 0.9%CVE-2023-1854MEDIUMSourceCodester Online Graduate Tracer System session expirationEPSS 0.9%CVE-2020-1776LOWInvalidating or changing user does not invalidate sessionEPSS 0.9%CVE-2022-2306HIGHInsufficient Session Expiration in heroiclabs/nakamaEPSS 0.9%CVE-2023-36252—An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial ofEPSS 0.9%CVE-2022-33137—A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All veEPSS 0.8%CVE-2021-37693MEDIUMRe-use of email tokens in DiscourseEPSS 0.8%CVE-2020-1724MEDIUMA flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal inEPSS 0.8%