cve.bz

CWE-613: Insufficient Session Expiration, page 11

Filter

deprecated by MITRE see CWE-1463, CWE-1464

This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

What the weakness is: CWE-613 at MITRE

Ask an AI about CWE-613

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-613: Insufficient Session Expiration and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/613.html and https://cve.bz/cve/cwe/613?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2022-41672EPSS 1.5%

    In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

  2. 5.3CVE-2019-5641EPSS 0.4%

    Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in t…

  3. 4.4CVE-2022-2888EPSS 0.3%

    If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.

  4. 7.5CVE-2022-3080EPSS 2.0%

    By sending specific queries to the resolver, an attacker can cause named to crash.

  5. 5.4CVE-2022-31677EPSS 0.5%

    An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their sessio…

  6. 5.9CVE-2022-34624EPSS 0.6%

    Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.

  7. 9.8CVE-2022-2713EPSS 1.3%

    Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.

  8. 9.8CVE-2022-35728EPSS 0.7%

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl RE…

  9. 6.5CVE-2022-30699EPSS 1.2%

    NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached …

  10. 6.5CVE-2022-30698EPSS 1.2%

    NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. T…

  11. 6.5CVE-2022-31145EPSS 1.0%

    FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and …

  12. 8.0CVE-2022-33137EPSS 0.9%

    A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMAT…

  13. 7.5CVE-2022-2306EPSS 0.9%

    Old session tokens can be used to authenticate to the application and send authenticated requests.

  14. 9.8CVE-2022-22318EPSS 0.4%

    IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

  15. 9.8CVE-2022-22317EPSS 0.5%

    IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281.

  16. 7.2CVE-2022-31050EPSS 1.3%

    TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was …

  17. 8.8CVE-2022-2064EPSS 1.2%

    Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.

  18. 5.7CVE-2022-30277EPSS 0.2%

    BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health inf…

  19. 8.8CVE-2022-23669EPSS 1.1%

    A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that a…

  20. 9.1CVE-2022-24042EPSS 1.0%

    A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web …

  21. 3.3CVE-2021-27751EPSS 0.2%

    HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.

  22. 8.8CVE-2022-23063EPSS 1.2%

    In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even a…

  23. 7.1CVE-2021-3461EPSS 0.3%

    A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

  24. 6.5CVE-2022-25590EPSS 1.3%

    SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.

  25. 7.1CVE-2022-0991EPSS 1.0%

    Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.

  26. 8.2CVE-2022-24743EPSS 1.3%

    Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the e…

  27. 3.5CVE-2022-24744EPSS 0.5%

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved i…

  28. 8.8CVE-2022-24732EPSS 0.4%

    Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upg…

  29. 5.4CVE-2021-38986EPSS 0.5%

    IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942.

  30. 7.5CVE-2022-24341EPSS 0.8%

    In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.

  31. 5.3CVE-2022-24332EPSS 0.7%

    In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

  32. 9.8CVE-2021-25992EPSS 1.6%

    In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical a…

  33. 9.8CVE-2021-22820EPSS 1.1%

    A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has chan…

  34. 2.7CVE-2021-29846EPSS 0.6%

    IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 205256.

  35. 7.5CVE-2021-37866EPSS 0.7%

    Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

  36. 8.8CVE-2022-22113EPSS 1.0%

    In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the…

  37. 3.3CVE-2022-22283EPSS 0.2%

    Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App.

  38. 8.1CVE-2022-21652EPSS 0.8%

    Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created …

  39. 9.8CVE-2021-25981EPSS 2.5%

    In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even w…

  40. 7.5CVE-2021-45885EPSS 0.9%

    An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password.

  41. 9.1CVE-2021-35034EPSS 1.1%

    An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.

  42. 9.8CVE-2020-27416EPSS 1.6%

    Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account.

  43. 5.3CVE-2021-43791EPSS 0.7%

    Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the …

  44. 9.8CVE-2021-36330EPSS 1.2%

    Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to reuse old session artifacts to impersonate a leg…

  45. 9.1CVE-2021-42545EPSS 1.1%

    An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.

  46. 9.8CVE-2021-25985EPSS 0.8%

    In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does…

  47. 8.0CVE-2021-25940EPSS 0.8%

    In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perfo…

  48. 9.8CVE-2021-25979EPSS 1.1%

    Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those …

  49. 7.5CVE-2021-41247EPSS 0.8%

    JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credential…

  50. 8.1CVE-2021-34739EPSS 1.7%

    A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based m…