Falhas do tipo CWE-384

274 resultados

Fixação de Sessão

Fraqueza onde um atacante força a vítima a usar um identificador de sessão conhecido e controlado pelo atacante, em vez de receber um novo ID gerado pela aplicação. Após a vítima autenticar-se, o atacante reutiliza esse ID fixo para acessar a conta com os privilégios da vítima.

Exemplo

Um site envia um cookie de sessão (ex: SESSID=abc123) antes do login. O atacante convence a vítima a acessar um link contendo esse SESSID=abc123, depois que a vítima faz login, o atacante usa o mesmo cookie para acessar a conta autenticada da vítima.

Como mitigar

Gere sempre um novo ID de sessão após autenticação bem-sucedida, descartando qualquer ID anterior. Valide e resete a sessão no servidor a cada mudança de privilégio (login/logout). Use flags seguras no cookie: HttpOnly, Secure e SameSite.

CVE-2025-56746LOWCreativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation EPSS 0.2%CVE-2026-59883MEDIUMGuzzle: Cookie Disclosure and Injection via IP-Address DomainsEPSS 0.2%CVE-2025-68139MEDIUMIn EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processingEPSS 0.2%CVE-2025-43516LOWA session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS TahoeEPSS 0.2%CVE-2025-36115MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2026-57179MEDIUMsocial-auth-core has a Session Fixation issueEPSS 0.2%CVE-2026-115910MEDIUMPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimEPSS 0.2%CVE-2026-33384MEDIUMSession Fixation in QuickCMSEPSS 0.2%CVE-2025-71057HIGHImproper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attEPSS 0.1%CVE-2023-24477MEDIUMSession Fixation in Guardian/CMC before 22.6.2EPSS 0.1%CVE-2025-12390MEDIUMOrg.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session idEPSS 0.1%CVE-2026-45773MEDIUMTurborepo: Login callback CSRF/session fixationEPSS 0.1%CVE-2026-53900MEDIUMCookie injection was possible when opening a PDF linkEPSS 0.1%CVE-2023-21239—In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could leEPSS 0.1%