CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length
Filter
The J2EE application is configured to use an insufficient session ID length.
What the weakness is: CWE-6 at MITRE. All weaknesses
Related attack patterns (CAPEC): 2
- CAPEC-21 Exploitation of Trusted Identifiers Likelihood: High · Severity: High
- CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-6, as MITRE names them. Credits.
Ask an AI about CWE-6
Show the prompt
Explain CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/6.html and https://cve.bz/cve/cwe/6?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2018-12538EPSS 2.6%
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even dele…