cve.bz

CWE-613: Insufficient Session Expiration, page 8

Filter

deprecated by MITRE see CWE-1463, CWE-1464

This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

What the weakness is: CWE-613 at MITRE

Ask an AI about CWE-613

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-613: Insufficient Session Expiration and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/613.html and https://cve.bz/cve/cwe/613?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2024-55603EPSS 0.5%

    Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionH…

  2. 6.3CVE-2024-12667EPSS 0.5%

    A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched …

  3. 5.3CVE-2024-11668EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access…

  4. 6.5CVE-2024-35160EPSS 0.4%

    IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration.

  5. 6.3CVE-2024-11208EPSS 0.8%

    A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. …

  6. 8.8CVE-2024-52553EPSS 0.7%

    Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.

  7. 6.9CVE-2024-46892EPSS 0.3%

    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This cou…

  8. 9.1CVE-2021-35473EPSS 0.4%

    An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access t…

  9. 5.3CVE-2024-52311EPSS 0.5%

    Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.

  10. 3.1CVE-2024-48926EPSS 0.3%

    Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout…

  11. 7.1CVE-2024-45462EPSS 0.4%

    The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired se…

  12. 8.8CVE-2024-48827ExploitEPSS 2.8%

    An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.

  13. 6.5CVE-2024-46040EPSS 0.3%

    IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-F…

  14. 8.7CVE-2024-43685EPSS 0.4%

    Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

  15. 7.5CVE-2024-23586EPSS 0.3%

    HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.

  16. 7.5CVE-2024-8888EPSS 0.4%

    An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token the…

  17. 6.5CVE-2024-38315EPSS 0.2%

    IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

  18. 5.3CVE-2024-32006EPSS 0.3%

    A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authenti…

  19. 8.8CVE-2024-45187EPSS 0.5%

    Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server

  20. 2.6CVE-2024-7998EPSS 0.2%

    In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.

  21. 8.9CVE-2024-39809EPSS 0.4%

    The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

  22. 8.8CVE-2022-45862EPSS 0.4%

    An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all ve…

  23. 4.1CVE-2022-38382EPSS 0.3%

    IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. …

  24. 9.8CVE-2024-42447EPSS 0.9%

    Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented…

  25. 5.5CVE-2023-26288EPSS 0.2%

    IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477.

  26. 7.5CVE-2022-32759EPSS 0.4%

    IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 uses insufficient session expiration which could allow an unauthorized user to obtain sensitive information. IBM X-Force ID: 228565.

  27. 9.1CVE-2024-29070EPSS 0.8%

    On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests an…

  28. 9.8CVE-2024-41827EPSS 0.4%

    In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration

  29. 9.8CVE-2024-27782EPSS 0.7%

    Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests.

  30. 7.8CVE-2024-36041EPSS 0.3%

    KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to…

  31. 8.8CVE-2024-5995EPSS 0.4%

    The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused.

  32. 6.5CVE-2024-36523EPSS 0.3%

    An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or administrator accounts. This is provided that the users do not log out of their deleted accounts.

  33. 8.5CVE-2024-35206EPSS 0.3%

    A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not expire the session. This could allow an attacker to get unauthorized access.

  34. 8.8CVE-2024-4680EPSS 0.4%

    A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attack…

  35. 7.4CVE-2024-35220EPSS 0.4%

    @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly…

  36. 8.8CVE-2024-35050EPSS 0.7%

    An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.

  37. 9.1CVE-2024-35049EPSS 0.7%

    SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.

  38. 4.3CVE-2024-35048EPSS 0.4%

    An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.

  39. 5.4CVE-2024-34709EPSS 0.4%

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets dest…

  40. 8.8CVE-2024-34092EPSS 0.4%

    An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release.

  41. 8.8CVE-2023-40695EPSS 0.4%

    IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.

  42. 4.3CVE-2024-29402EPSS 0.5%

    cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity.

  43. 8.8CVE-2024-22358EPSS 0.4%

    IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to …

  44. 7.4CVE-2024-31999EPSS 0.6%

    @festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cooki…

  45. 4.3CVE-2024-31995EPSS 0.4%

    `@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `ex…

  46. 7.1CVE-2024-30262EPSS 0.6%

    Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone …

  47. 5.3CVE-2024-31447EPSS 0.5%

    Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be c…

  48. 7.5CVE-2024-25954EPSS 0.6%

    Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.

  49. 9.8CVE-2024-29401EPSS 0.8%

    xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.

  50. 7.8CVE-2024-1623EPSS 0.2%

    Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is poss…