Fallos del tipo CWE-613

473 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2023-0041MEDIUMIBM Security Guardium session fixationEPSS 0.5%CVE-2024-22403LOWOAuth2 authorization codes are valid indefinetly in Nextcloud serverEPSS 0.5%CVE-2024-34709MEDIUMDirectus Lacks Session Tokens InvalidationEPSS 0.4%CVE-2022-40230MEDIUM"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to iEPSS 0.4%CVE-2024-35220HIGH@fastify/session reuses destroyed session cookieEPSS 0.4%CVE-2025-46815HIGHZITADEL Allows IdP Intent Token ReuseEPSS 0.4%CVE-2022-45862LOWAn insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; ForEPSS 0.4%CVE-2022-47406MEDIUMAn issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPOEPSS 0.4%CVE-2026-49229HIGHActual: Disabled OpenID users keep access through existing session tokensEPSS 0.4%CVE-2024-31995MEDIUMzcap has incomplete expiration checks in capability chains.EPSS 0.4%CVE-2023-5889MEDIUMInsufficient Session Expiration in pkp/pkp-libEPSS 0.4%CVE-2024-43685HIGHSession token fixation in TimeProvider 4100EPSS 0.4%CVE-2025-40566HIGHA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 UpdateEPSS 0.4%CVE-2024-39809HIGHBIG-IP Next Central Manager vulnerabilityEPSS 0.4%CVE-2023-1788MEDIUMInsufficient Session Expiration in firefly-iii/firefly-iiiEPSS 0.4%CVE-2026-54779MEDIUMCoreWCF: SAML token replay protection is inoperativeEPSS 0.4%CVE-2023-33303HIGHA insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands EPSS 0.4%CVE-2023-33005MEDIUMJenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.EPSS 0.4%CVE-2021-47740MEDIUMKZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration VulnerabilityEPSS 0.4%CVE-2026-27575CRITICALVijkunja has Weak Password Policy Combined with Persistent Sessions After Password ChangeEPSS 0.4%