Falhas do tipo CWE-384

253 resultados

Fixação de Sessão

Fraqueza onde um atacante força a vítima a usar um identificador de sessão conhecido e controlado pelo atacante, em vez de receber um novo ID gerado pela aplicação. Após a vítima autenticar-se, o atacante reutiliza esse ID fixo para acessar a conta com os privilégios da vítima.

Exemplo

Um site envia um cookie de sessão (ex: SESSID=abc123) antes do login. O atacante convence a vítima a acessar um link contendo esse SESSID=abc123, depois que a vítima faz login, o atacante usa o mesmo cookie para acessar a conta autenticada da vítima.

Como mitigar

Gere sempre um novo ID de sessão após autenticação bem-sucedida, descartando qualquer ID anterior. Valide e resete a sessão no servidor a cada mudança de privilégio (login/logout). Use flags seguras no cookie: HttpOnly, Secure e SameSite.

CVE-2024-23590CRITICALApache Kylin: Session fixation in web interfaceEPSS 0.7%CVE-2022-40293CRITICALSession fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.7%CVE-2022-44788MEDIUMAn issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that isEPSS 0.6%CVE-2024-10158MEDIUMPHPGurukul Boat Booking System session_start session fixiationEPSS 0.6%CVE-2022-43687MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authenticatEPSS 0.6%CVE-2023-52268CRITICALThe End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session tEPSS 0.6%CVE-2014-125048MEDIUMkassi xingwall oauth.js session fixiationEPSS 0.6%CVE-2024-0351LOWSourceCodester Engineers Online Portal session fixiationEPSS 0.6%CVE-2024-25977HIGHSession FixationEPSS 0.6%CVE-2018-16463—A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access tEPSS 0.5%CVE-2024-2639MEDIUMBdtask Wholesale Inventory Management System session fixiationEPSS 0.5%CVE-2023-27490HIGHMissing proper state, nonce and PKCE checks for OAuth authentication in next-authEPSS 0.5%CVE-2022-24745MEDIUMGuest session is shared between customers in shopwareEPSS 0.5%CVE-2022-43398HIGHA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 0.5%CVE-2026-41613HIGHVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-31221MEDIUMClients removed during unpairing process may regain access if Sunshine was not restartedEPSS 0.5%CVE-2023-3394MEDIUMSession Fixation in fossbilling/fossbillingEPSS 0.5%CVE-2024-57052CRITICALAn issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php fileEPSS 0.5%CVE-2025-27661CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.EPSS 0.5%CVE-2024-30262MEDIUMContao's remember-me tokens will not be cleared after a password changeEPSS 0.5%