Fallos del tipo CWE-613

546 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2023-33303HIGHA insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands EPSS 0.5%CVE-2026-24472MEDIUMHono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionEPSS 0.5%CVE-2024-55603MEDIUMInsufficient session invalidation in KanboardEPSS 0.5%CVE-2026-65984HIGHFUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessionsEPSS 0.5%CVE-2023-51772HIGHOne Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on theEPSS 0.5%CVE-2026-87014MEDIUMOpen WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notesEPSS 0.5%CVE-2026-114137HIGHDjango REST framework: TokenProxy.delete() reports success and revokes nothingEPSS 0.5%CVE-2026-84480CRITICALWWBN AVideo Password Recovery Token Expiration BypassEPSS 0.5%CVE-2024-21722MEDIUM[20240201] - Core - Insufficient session expiration in MFA management viewsEPSS 0.5%CVE-2026-34572HIGHCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.5%CVE-2026-34570HIGHCI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.5%CVE-2022-3867LOWNomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedEPSS 0.5%CVE-2022-40230MEDIUM"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to iEPSS 0.5%CVE-2023-28001MEDIUMAn insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or cEPSS 0.5%CVE-2024-0008MEDIUMPAN-OS: Insufficient Session Expiration Vulnerability in the Web InterfaceEPSS 0.5%CVE-2026-48079HIGHOpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryEPSS 0.5%CVE-2025-4754LOWMissing Session Revocation on Logout in ash_authentication_phoenixEPSS 0.5%CVE-2024-31447MEDIUMShopware has Improper Session Handling in store-apiEPSS 0.5%CVE-2024-22389HIGHBIG-IP iControl REST API VulnerabilityEPSS 0.5%CVE-2026-24894HIGHFrankenPHP leaks session data between requests in worker modeEPSS 0.5%