cve.bz

CWE-539: Use of Persistent Cookies Containing Sensitive Information

Filter

The web application uses persistent cookies, but the cookies contain sensitive information.

What the weakness is: CWE-539 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 5
  • CAPEC-21 Exploitation of Trusted Identifiers Likelihood: High · Severity: High
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-39 Manipulating Opaque Client-based Data Tokens Likelihood: High · Severity: Medium
  • CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-539, as MITRE names them. Credits.

Ask an AI about CWE-539

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-539: Use of Persistent Cookies Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/539.html and https://cve.bz/cve/cwe/539?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.3CVE-2026-35192EPSS 0.5%

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that us…

  2. 4.2CVE-2026-24318EPSS 0.2%

    Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If …

  3. 5.3CVE-2025-52633EPSS 0.2%

    HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or co…

  4. 9.1CVE-2025-27673EPSS 0.5%

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20230524-0017.

  5. 8.5CVE-2024-39275EPSS 0.4%

    Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if the session was terminated, allows an unauthorized attacker to act with the s…

  6. 7.5CVE-2023-30861EPSS 1.2%

    Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also ca…

  7. 5.3CVE-2021-27463EPSS 0.9%

    A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications utilize persistent cookies where the session cookie attribute is not properly invalidated, allowing an attacker to i…