Fallos del tipo CWE-613

544 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2025-28059HIGHAn access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improEPSS 0.8%CVE-2021-37693MEDIUMRe-use of email tokens in DiscourseEPSS 0.8%CVE-2026-86462CRITICALApache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsEPSS 0.8%CVE-2020-1724MEDIUMA flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal inEPSS 0.8%CVE-2022-21652LOWInsufficient Session Expiration in shopwareEPSS 0.8%CVE-2026-26342HIGHTattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token ExpirationEPSS 0.8%CVE-2023-38489HIGHKirby vulnerable to Insufficient Session Expiration after a password changeEPSS 0.8%CVE-2021-25940HIGHArangoDB - Insufficient Session Expiration after Password ChangeEPSS 0.8%CVE-2021-41247LOWincomplete logout in JupyterHubEPSS 0.8%CVE-2024-29070CRITICALApache StreamPark: session not invalidated after logoutEPSS 0.8%CVE-2024-29401CRITICALxzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.EPSS 0.8%CVE-2021-25985HIGHFactorJS - Insufficient Session Expiration Leads to a Local Account TakeoverEPSS 0.8%CVE-2022-41542MEDIUMdevhub 0.102.0 was discovered to contain a broken session control.EPSS 0.8%CVE-2023-1543MEDIUMInsufficient Session Expiration in answerdev/answerEPSS 0.8%CVE-2020-15218MEDIUMAdmin pages are cached and can be embeddedEPSS 0.8%CVE-2023-49091HIGHJwttoken in Cosmos server never expires after password changed and logging outEPSS 0.8%CVE-2023-22732LOWInsufficient Session Expiration in Administration in shopwareEPSS 0.8%CVE-2024-11208MEDIUMApereo CAS login session expirationEPSS 0.8%CVE-2020-1768MEDIUMExternal Interface does not invalidate sessionEPSS 0.7%CVE-2026-86473CRITICALApache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryEPSS 0.7%