cve.bz

CWE-384: Session Fixation, page 6

Filter

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

What the weakness is: CWE-384 at MITRE

Ask an AI about CWE-384

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-384: Session Fixation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/384.html and https://cve.bz/cve/cwe/384?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.8CVE-2022-25896EPSS 1.1%

    This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

  2. 6.5CVE-2022-24444EPSS 0.9%

    Silverstripe silverstripe/framework through 4.10 allows Session Fixation.

  3. 8.8CVE-2022-27305EPSS 0.9%

    Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.

  4. 5.4CVE-2022-1849EPSS 0.8%

    Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.

  5. 9.8CVE-2021-38869EPSS 0.9%

    IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341.

  6. 8.1CVE-2020-25152EPSS 1.3%

    A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate p…

  7. 7.5CVE-2022-26591EPSS 1.1%

    FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request.

  8. 7.1CVE-2022-24781EPSS 0.9%

    Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patc…

  9. 6.5CVE-2022-24745EPSS 0.5%

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experienc…

  10. 8.8CVE-2021-39066EPSS 0.6%

    IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040.

  11. 8.8CVE-2022-22551EPSS 0.4%

    DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session.

  12. 10.0CVE-2021-20151EPSS 1.7%

    Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This al…

  13. 7.5CVE-2021-31745EPSS 1.2%

    Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even…

  14. 8.8CVE-2021-41246EPSS 0.9%

    Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior open…

  15. 8.8CVE-2021-41268EPSS 1.3%

    Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated wh…

  16. 8.2CVE-2021-42073EPSS 1.5%

    An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client co…

  17. 9.8CVE-2021-41553EPSS 1.2%

    In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user w…

  18. 5.4CVE-2021-35948EPSS 0.7%

    Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.

  19. 4.9CVE-2021-22237EPSS 0.8%

    Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2

  20. 9.8CVE-2021-39290EPSS 1.5%

    Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB37…

  21. 8.1CVE-2021-22927EPSS 0.8%

    A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

  22. 8.3CVE-2021-2351EPSS 2.4%

    Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network acces…

  23. 7.5CVE-2021-32710EPSS 0.9%

    Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Update…

  24. 6.1CVE-2021-35046EPSS 0.8%

    A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted session cookie.

  25. 7.5CVE-2010-1434EPSS 0.9%

    Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.…

  26. 6.5CVE-2021-32676EPSS 1.0%

    Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. I…

  27. 5.4CVE-2021-33394EPSS 0.7%

    Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, …

  28. 8.8CVE-2018-16495EPSS 0.9%

    In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into the application. Failing to issue a new session ID following a successful login…

  29. 8.8CVE-2020-35229EPSS 0.8%

    The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused until a new token is generated, which allows attackers (with access to network tr…

  30. 4.8CVE-2019-18946EPSS 0.3%

    Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.

  31. 5.4CVE-2020-35591EPSS 1.1%

    Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the vic…

  32. 5.4CVE-2020-4954EPSS 0.6%

    IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker co…

  33. 4.4CVE-2020-5021EPSS 0.2%

    IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657.

  34. 8.8CVE-2020-25198EPSS 1.4%

    The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s c…

  35. 5.4CVE-2020-4555EPSS 0.8%

    IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.

  36. 7.5CVE-2020-5645EPSS 3.9%

    Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS …

  37. 7.5CVE-2020-5654EPSS 2.7%

    Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module Fir…

  38. 5.3CVE-2019-4563EPSS 0.9%

    IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the use…

  39. 8.8CVE-2020-15909EPSS 2.2%

    SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as t…

  40. 7.5CVE-2020-10714EPSS 1.5%

    A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerabili…

  41. 8.1CVE-2020-6302EPSS 0.8%

    SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequentl…

  42. 3.7CVE-2020-4243EPSS 0.9%

    IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle techniques due to not properly invalidating session tokens. IBM X-Force ID: 175…

  43. 5.9CVE-2020-4527EPSS 1.3%

    IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie in TLS mode. By intercepting its transmission within an HTTP session, an attacker…

  44. 6.3CVE-2020-6290EPSS 0.6%

    SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.

  45. 7.8CVE-2019-4591EPSS 0.3%

    IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 167451.

  46. 7.5CVE-2020-5596EPSS 1.6%

    TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) does not properly manage sessions, which may allow a remote attacker to…

  47. 6.5CVE-2020-15018EPSS 0.9%

    playSMS through 1.4.3 is vulnerable to session fixation.

  48. 7.3CVE-2020-4229EPSS 0.9%

    IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain unauthorized access to a user's session. IBM X-Force ID: 175211.

  49. 8.8CVE-2020-13229EPSS 1.6%

    An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token.

  50. 9.8CVE-2020-8434EPSS 1.3%

    Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBK…