CWE-384: Session Fixation, page 5

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

What the weakness is: CWE-384 at MITRE

1. 5.3CVE-2023-34156EPSS 0.4%2023-06-19

   Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied.

2. 7.5CVE-2023-28809EPSS 0.6%2023-06-15

   Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the s…

3. 5.4CVE-2023-3192EPSS 0.4%2023-06-11

   Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.

4. 8.8CVE-2023-32997EPSS 0.8%2023-05-16

   Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.

5. 9.8CVE-2023-31498EPSS 2.1%2023-05-11

   A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter.

6. 9.8CVE-2023-28316EPSS 0.7%2023-05-09

   A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a co…

7. 7.5CVE-2023-30056EPSS 0.7%2023-05-09

   A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie.

8. 4.5CVE-2023-1265EPSS 0.8%2023-05-03

   An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacke…

9. 6.5CVE-2023-29020EPSS 0.4%2023-04-21

   @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affecte…

10. 8.1CVE-2023-29019EPSS 0.8%2023-04-21

    @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session…

11. 8.8CVE-2023-2105EPSS 0.7%2023-04-15

    Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

12. 5.4CVE-2023-26260EPSS 0.4%2023-04-11

    OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attacker, due to an improper check of the user agent.

13. 8.8CVE-2022-31888EPSS 1.2%2023-04-05

    Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.

14. 8.8CVE-2023-27490EPSS 0.5%2023-03-09

    NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can r…

15. 9.8CVE-2021-36394EPSS 7.0%2023-03-06

    In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

16. 9.8CVE-2021-42761EPSS 1.5%2023-02-16

    A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a …

17. 8.8CVE-2022-24895EPSS 0.8%2023-02-03

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because thi…

18. 9.8CVE-2023-24456EPSS 1.2%2023-01-26

    Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.

19. 9.8CVE-2023-24427EPSS 1.1%2023-01-26

    Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.

20. 8.8CVE-2023-24424EPSS 1.2%2023-01-26

    Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.

21. 8.8CVE-2021-29368EPSS 0.7%2023-01-20

    Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions.

22. 6.5CVE-2023-22479EPSS 0.4%2023-01-10

    KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.

23. 5.4CVE-2014-125048EPSS 0.6%2023-01-06

    A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The patch is named e9f0d509e…

24. 5.4CVE-2022-43529EPSS 0.4%2023-01-05

    A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of thi…

25. 9.1CVE-2022-36437EPSS 1.1%2022-12-29

    The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are …

26. 7.5CVE-2022-44017EPSS 0.8%2022-12-25

    An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can be used for this. This is due to the cr…

27. 7.6CVE-2020-15679EPSS 0.5%2022-12-22

    An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to case…

28. 6.1CVE-2022-38628EPSS 0.9%2022-12-13

    Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) vulnerability which is chained with a local session fixation. This vulnerabilit…

29. 5.4CVE-2022-4231EPSS 0.5%2022-11-30

    A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The…

30. 6.5CVE-2022-44788EPSS 0.7%2022-11-21

    An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is issued by the server at the first visit, the cookie value is not updated after a successful login.

31. 8.8CVE-2022-44007EPSS 0.9%2022-11-16

    An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the a…

32. 4.6CVE-2022-30769EPSS 0.5%2022-11-15

    Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.

33. 5.4CVE-2022-43687EPSS 0.6%2022-11-14

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

34. 9.8CVE-2022-31689EPSS 0.9%2022-11-09

    VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.

35. 8.8CVE-2022-43398EPSS 0.5%2022-11-08

    A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected dev…

36. 9.8CVE-2022-40293EPSS 0.8%2022-10-31

    The application was vulnerable to a session fixation that could be used hijack accounts.

37. 8.8CVE-2021-46279EPSS 0.5%2022-10-24

    Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

38. 8.1CVE-2022-40226EPSS 0.8%2022-10-11

    A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-2AA0) …

39. 6.5CVE-2022-34334EPSS 0.4%2022-10-10

    IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704.

40. 9.8CVE-2022-40630EPSS 1.1%2022-09-23

    This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interfac…

41. 9.8CVE-2022-3269EPSS 0.9%2022-09-23

    Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.

42. 8.8CVE-2022-38369EPSS 1.3%2022-09-05

    Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.

43. 9.8CVE-2022-38054EPSS 2.2%2022-09-02

    In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.

44. 6.1CVE-2022-31798ExploitEPSS 8.7%2022-08-25

    Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user a…

45. 8.0CVE-2022-2997EPSS 0.9%2022-08-25

    Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.

46. 8.8CVE-2022-30605EPSS 5.0%2022-08-22

    A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to…

47. 8.2CVE-2022-2820EPSS 0.7%2022-08-15

    Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2.

48. 6.5CVE-2022-33927EPSS 0.5%2022-08-10

    Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session.

49. 7.5CVE-2022-34536EPSS 0.7%2022-07-19

    Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token.

50. 7.5CVE-2022-22681EPSS 1.0%2022-07-06

    Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.