CWE-488: Exposure of Data Element to Wrong Session, page 2
Filter
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
What the weakness is: CWE-488 at MITRE
Related attack patterns (CAPEC): 2
- CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
- CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-488, as MITRE names them. Credits.
Ask an AI about CWE-488
Show the prompt
Explain CWE-488: Exposure of Data Element to Wrong Session and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/488.html and https://cve.bz/cve/cwe/488?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.6CVE-2024-38367EPSS 11%
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Comprom…
- 7.5CVE-2024-6162EPSS 1.7%
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneo…
- 8.3CVE-2024-27935EPSS 0.7%
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asyn…
- 4.8CVE-2024-1223EPSS 0.4%
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. …
- 9.1CVE-2024-27455EPSS 0.6%
In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integ…
- 7.5CVE-2023-6519EPSS 0.5%
Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: before 1.0.7.
- 7.8CVE-2022-40210EPSS 0.2%
Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.