Fallos del tipo CWE-613

467 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2025-28059HIGHAn access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improEPSS 0.8%CVE-2023-38489HIGHKirby vulnerable to Insufficient Session Expiration after a password changeEPSS 0.8%CVE-2021-25940HIGHArangoDB - Insufficient Session Expiration after Password ChangeEPSS 0.8%CVE-2026-86462CRITICALApache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsEPSS 0.8%CVE-2021-41247LOWincomplete logout in JupyterHubEPSS 0.8%CVE-2022-21652LOWInsufficient Session Expiration in shopwareEPSS 0.8%CVE-2024-29070CRITICALApache StreamPark: session not invalidated after logoutEPSS 0.8%CVE-2024-29401CRITICALxzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.EPSS 0.8%CVE-2021-25985HIGHFactorJS - Insufficient Session Expiration Leads to a Local Account TakeoverEPSS 0.8%CVE-2023-1543MEDIUMInsufficient Session Expiration in answerdev/answerEPSS 0.8%CVE-2023-49091HIGHJwttoken in Cosmos server never expires after password changed and logging outEPSS 0.8%CVE-2020-15218MEDIUMAdmin pages are cached and can be embeddedEPSS 0.8%CVE-2024-11208MEDIUMApereo CAS login session expirationEPSS 0.8%CVE-2020-1768MEDIUMExternal Interface does not invalidate sessionEPSS 0.7%CVE-2022-37186MEDIUMIn LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting.EPSS 0.7%CVE-2023-22732LOWInsufficient Session Expiration in Administration in shopwareEPSS 0.7%CVE-2024-35049CRITICALSurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.EPSS 0.7%CVE-2023-37570HIGHInsufficient Session Expiration Vulnerability in Emagic Data Center Management SuiteEPSS 0.7%CVE-2024-27782HIGHMultiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stoEPSS 0.7%CVE-2021-37866MEDIUMSession is not invalidated on server-side when user logged out of BoardsEPSS 0.7%