CWE-613: Insufficient Session Expiration, page 10
Filter
deprecated by MITRE see CWE-1463, CWE-1464
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
What the weakness is: CWE-613 at MITRE
Ask an AI about CWE-613
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-613: Insufficient Session Expiration and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/613.html and https://cve.bz/cve/cwe/613?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.4CVE-2023-37919EPSS 0.3%
Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the …
- 9.8CVE-2023-28001EPSS 0.5%
An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.
- 8.8CVE-2023-36252EPSS 0.9%
An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the session expiration function.
- 9.8CVE-2023-35857EPSS 0.6%
In Siren Investigate before 13.2.2, session keys remain active even after logging out.
- 6.5CVE-2023-2788EPSS 0.5%
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's accoun…
- 8.8CVE-2023-0041EPSS 0.5%
IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657.
- 6.7CVE-2023-32318EPSS 0.2%
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After succes…
- 9.1CVE-2023-31065EPSS 1.2%
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old session can be used by an attacker even after the user has been deleted or the …
- 5.4CVE-2023-33005EPSS 0.4%
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.
- 7.5CVE-2023-31139EPSS 0.6%
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted se…
- 6.5CVE-2023-31140EPSS 0.9%
OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessi…
- 4.2CVE-2020-4914EPSS 0.1%
IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 191290.
- 5.5CVE-2022-38707EPSS 0.2%
IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179.
- 7.5CVE-2023-30403EPSS 14%
An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user.
- 8.8CVE-2023-28003EPSS 0.3%
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.
- 5.9CVE-2022-37186EPSS 0.7%
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the t…
- 9.8CVE-2023-1788EPSS 0.4%
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
- 9.8CVE-2023-1854EPSS 0.9%
A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the file admin/. The manipulation leads to session expiration. It is possible to launch…
- 4.3CVE-2023-20903EPSS 0.4%
This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that ide…
- 5.4CVE-2021-3844EPSS 0.4%
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unre…
- 8.8CVE-2023-1543EPSS 0.8%
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
- 3.2CVE-2023-22591EPSS 0.2%
IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password reset. IBM X-Force ID: 243710.
- 7.5CVE-2023-27891EPSS 0.6%
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
- 8.8CVE-2023-23929EPSS 0.6%
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- 2.4CVE-2023-22771EPSS 0.4%
An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impact…
- 9.8CVE-2022-48317EPSS 0.5%
Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI.
- 9.8CVE-2023-25562EPSS 0.4%
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` me…
- 5.5CVE-2022-34392EPSS 0.2%
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sen…
- 8.8CVE-2022-24895EPSS 0.8%
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because thi…
- 8.8CVE-2023-24426EPSS 1.0%
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
- 8.8CVE-2023-23614EPSS 1.0%
Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Reme…
- 9.8CVE-2023-22732EPSS 0.8%
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In v…
- 6.5CVE-2023-0227EPSS 0.7%
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- 5.9CVE-2023-22492EPSS 0.6%
ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not …
- 8.1CVE-2022-46177EPSS 0.7%
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, when a user requests for a password reset link email, then changes their …
- 8.8CVE-2022-43844EPSS 0.7%
IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 2390…
- 6.5CVE-2022-22371EPSS 0.3%
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195.
- 9.8CVE-2022-47406EPSS 0.5%
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been …
- 5.4CVE-2022-23502EPSS 0.4%
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particu…
- 5.4CVE-2022-40228EPSS 0.4%
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impers…
- 9.8CVE-2022-36179EPSS 1.0%
Fusiondirectory 1.3 suffers from Improper Session Handling.
- 9.8CVE-2022-4070EPSS 0.7%
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.
- 9.8CVE-2022-3362EPSS 1.0%
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- 4.3CVE-2022-3867EPSS 0.5%
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.
- 6.5CVE-2022-40230EPSS 0.5%
"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532."
- 8.8CVE-2022-39234EPSS 0.5%
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to …
- 9.1CVE-2022-2782EPSS 0.7%
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
- 8.8CVE-2021-46279EPSS 0.5%
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
- 5.4CVE-2022-41542EPSS 0.8%
devhub 0.102.0 was discovered to contain a broken session control.
- 6.5CVE-2022-41291EPSS 0.4%
IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699.