Falhas do tipo CWE-384

253 resultados

Fixação de Sessão

Fraqueza onde um atacante força a vítima a usar um identificador de sessão conhecido e controlado pelo atacante, em vez de receber um novo ID gerado pela aplicação. Após a vítima autenticar-se, o atacante reutiliza esse ID fixo para acessar a conta com os privilégios da vítima.

Exemplo

Um site envia um cookie de sessão (ex: SESSID=abc123) antes do login. O atacante convence a vítima a acessar um link contendo esse SESSID=abc123, depois que a vítima faz login, o atacante usa o mesmo cookie para acessar a conta autenticada da vítima.

Como mitigar

Gere sempre um novo ID de sessão após autenticação bem-sucedida, descartando qualquer ID anterior. Valide e resete a sessão no servidor a cada mudança de privilégio (login/logout). Use flags seguras no cookie: HttpOnly, Secure e SameSite.

CVE-2022-24895MEDIUMSymfony vulnerable to Session Fixation of CSRF tokensEPSS 0.8%CVE-2020-5205MEDIUMSession fixation attack in Pow (Hex package)EPSS 0.8%CVE-2023-29019HIGHSession fixation in fastify-passportEPSS 0.8%CVE-2023-34656—An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackerEPSS 0.7%CVE-2025-63216CRITICALThe Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers EPSS 0.7%CVE-2024-37829HIGHAn issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in linkEPSS 0.7%CVE-2022-1849MEDIUMSession Fixation in filegator/filegatorEPSS 0.7%CVE-2023-6913HIGHSession Hijacking on Imou Life appEPSS 0.7%CVE-2023-53741MEDIUMScreen SFT DAB 1.9.3 Authentication Bypass via IP Session ManagementEPSS 0.7%CVE-2023-28316CRITICALA security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not iEPSS 0.7%CVE-2023-30056HIGHA session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cEPSS 0.7%CVE-2022-44017HIGHAn issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victiEPSS 0.7%CVE-2025-63224CRITICALThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers cEPSS 0.7%CVE-2021-29368HIGHSession fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gaiEPSS 0.7%CVE-2022-40226HIGHA vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versionsEPSS 0.7%CVE-2022-2820HIGHSession Fixation in namelessmc/namelessEPSS 0.7%CVE-2024-38513CRITICALFiber Session Middleware Token Injection VulnerabilityEPSS 0.7%CVE-2023-46733MEDIUMSymfony possible session fixation vulnerabilityEPSS 0.7%CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 0.7%CVE-2023-2105HIGHSession Fixation in alextselegidis/easyappointmentsEPSS 0.7%