Fallos del tipo CWE-613

549 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2020-1768MEDIUMExternal Interface does not invalidate sessionEPSS 0.7%CVE-2022-46177MEDIUMDiscourse password reset link can lead to in account takeover if user changes to a new emailEPSS 0.7%CVE-2022-43844HIGHIBM Robotic Process Automation for Cloud Pak session fixationEPSS 0.7%CVE-2022-37186MEDIUMIn LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting.EPSS 0.7%CVE-2024-35049CRITICALSurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.EPSS 0.7%CVE-2024-27782HIGHMultiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stoEPSS 0.7%CVE-2023-37570HIGHInsufficient Session Expiration Vulnerability in Emagic Data Center Management SuiteEPSS 0.7%CVE-2021-37866MEDIUMSession is not invalidated on server-side when user logged out of BoardsEPSS 0.7%CVE-2024-21492MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessioEPSS 0.7%CVE-2023-5865HIGHInsufficient Session Expiration in thorsten/phpmyfaqEPSS 0.7%CVE-2020-15220MEDIUMSession fixationEPSS 0.7%CVE-2024-35050HIGHAn issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.EPSS 0.7%CVE-2025-3930MEDIUMLack of JWT Expiration after Log Out in StrapiEPSS 0.7%CVE-2026-46455CRITICALApache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be acceptedEPSS 0.7%CVE-2022-35728HIGHiControl REST vulnerability CVE-2022-35728EPSS 0.7%CVE-2026-28564CRITICALApache IoTDB: REST Basic Authentication Accepts Stale Cached CredentialsEPSS 0.7%CVE-2025-57735CRITICALApache Airflow: Airflow Logout Not Invalidating JWTEPSS 0.7%CVE-2023-0227HIGHInsufficient Session Expiration in pyload/pyloadEPSS 0.7%CVE-2021-43791MEDIUMIneffective expiration validation for invitation links in ZulipEPSS 0.7%CVE-2024-52553HIGHJenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.EPSS 0.7%