cve.bz

CWE-384: Session Fixation, page 7

Filter

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

What the weakness is: CWE-384 at MITRE

Ask an AI about CWE-384

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-384: Session Fixation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/384.html and https://cve.bz/cve/cwe/384?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2020-12258EPSS 1.7%

    rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256…

  2. 5.4CVE-2020-1993EPSS 0.4%

    The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.…

  3. 8.1CVE-2020-5894EPSS 1.0%

    On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.

  4. 6.5CVE-2020-12467EPSS 0.9%

    Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.

  5. 8.6CVE-2020-1762EPSS 1.2%

    An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user s…

  6. 2.8CVE-2020-6824EPSS 0.3%

    Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same …

  7. 9.8CVE-2020-11729EPSS 2.2%

    An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful.

  8. 7.5CVE-2020-11728EPSS 1.6%

    An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can imperso…

  9. 7.5CVE-2020-8826EPSS 1.7%

    As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.

  10. 4.3CVE-2020-4291EPSS 1.2%

    IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334.

  11. 8.1CVE-2020-5550EPSS 1.9%

    Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to impersonate a registered user and log in the management console, that may result in information alte…

  12. 6.5CVE-2020-5290EPSS 0.8%

    In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify` endpoint. An attacker team could potentially steal flags by, for example, expl…

  13. 5.4CVE-2019-19610EPSS 0.9%

    An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.

  14. 4.4CVE-2019-4617EPSS 0.3%

    IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an atta…

  15. 9.8CVE-2020-5543EPSS 2.2%

    TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote attackers to stop the network functions or execute malware …

  16. 9.1CVE-2020-9370EPSS 1.2%

    HUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijacking.

  17. 9.1CVE-2020-8990EPSS 1.0%

    Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.

  18. 6.1CVE-2014-10400EPSS 1.2%

    The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.

  19. 6.1CVE-2014-10399EPSS 1.3%

    The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.

  20. 7.5CVE-2013-4572EPSS 2.1%

    The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the…

  21. 8.1CVE-2013-0507EPSS 1.2%

    IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability

  22. 5.9CVE-2019-15612EPSS 0.3%

    A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.

  23. 5.4CVE-2020-5205EPSS 0.8%

    In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in …

  24. 9.8CVE-2019-10158EPSS 2.0%

    A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

  25. 7.5CVE-2019-17563EPSS 11%

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an expl…

  26. 8.8CVE-2019-18573EPSS 1.0%

    The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the …

  27. 7.5CVE-2019-8116EPSS 1.9%

    Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a guest session id value following a successful login to gain …

  28. 7.5CVE-2019-10084EPSS 1.0%

    In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization…

  29. 6.5CVE-2010-3671EPSS 1.6%

    TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session.

  30. 8.8CVE-2019-17062EPSS 1.2%

    An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. …

  31. 9.8CVE-2019-18418ExploitEPSS 4.0%

    clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.

  32. 7.3CVE-2019-15849EPSS 0.8%

    eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins …

  33. 8.8CVE-2019-0062EPSS 1.1%

    A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and potentially gain administrative access to the device. This issue affe…

  34. 7.3CVE-2019-4227EPSS 1.1%

    IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 1…

  35. 6.3CVE-2019-4304EPSS 1.0%

    IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950.

  36. 7.5CVE-2019-6161EPSS 1.4%

    An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which cou…

  37. 6.3CVE-2019-12203EPSS 0.4%

    SilverStripe through 4.3.3 allows session fixation in the "change password" form.

  38. 8.8CVE-2019-13517EPSS 1.3%

    In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expira…

  39. 7.5CVE-2019-12258ExploitEPSS 23%

    Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.

  40. 7.2CVE-2019-5406EPSS 1.4%

    A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.

  41. 6.3CVE-2019-5400EPSS 0.9%

    A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.

  42. 7.5CVE-2019-10371EPSS 1.3%

    A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

  43. 7.5CVE-2019-7849EPSS 1.2%

    A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 pr…

  44. 5.3CVE-2019-4439EPSS 0.3%

    IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 162949.

  45. 8.8CVE-2019-10120EPSS 1.3%

    On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID after a logout, aka HMCCU-154.

  46. 4.4CVE-2019-4152EPSS 0.3%

    IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 1585…

  47. 8.8CVE-2019-6584EPSS 1.3%

    A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02). The integrated webserver does not …

  48. 6.5CVE-2019-10045EPSS 1.0%

    The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user…

  49. 8.8CVE-2019-1807EPSS 1.5%

    A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the a…

  50. 7.5CVE-2018-15208EPSS 1.1%

    BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.