CWE-613: Insufficient Session Expiration, page 9
Filter
deprecated by MITRE see CWE-1463, CWE-1464
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
What the weakness is: CWE-613 at MITRE
Ask an AI about CWE-613
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-613: Insufficient Session Expiration and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/613.html and https://cve.bz/cve/cwe/613?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.2CVE-2024-20301EPSS 0.3%
A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and access an affected Windows device. This vulnerability is due to a failure to i…
- 5.5CVE-2024-1900EPSS 0.2%
Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the…
- 9.8CVE-2023-45600EPSS 0.4%
A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below v…
- 6.3CVE-2024-21722EPSS 0.5%
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
- 6.1CVE-2024-22543EPSS 1.2%
An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /goform/* URI or via the ExportSettings function.
- 9.1CVE-2024-27455EPSS 0.6%
In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integ…
- 6.5CVE-2023-50270EPSS 1.3%
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
- 8.1CVE-2024-21492EPSS 0.7%
All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests …
- 7.6CVE-2024-25628EPSS 0.4%
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are…
- 4.3CVE-2024-25619EPSS 0.4%
Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security r…
- 8.8CVE-2024-0008EPSS 0.5%
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
- 7.2CVE-2024-22389EPSS 0.5%
When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- 9.8CVE-2024-25718EPSS 0.7%
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
- 7.5CVE-2023-45718EPSS 0.4%
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed ou…
- 8.8CVE-2023-45187EPSS 0.4%
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.
- 8.8CVE-2023-50936EPSS 0.4%
IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116.
- 5.3CVE-2024-0944EPSS 1.5%
A vulnerability was found in Totolink T8 4.1.5cu.833_20220905. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attac…
- 5.3CVE-2024-0943EPSS 0.6%
A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The a…
- 4.3CVE-2024-0942EPSS 0.7%
A vulnerability was found in Totolink N200RE V5 9.3.5u.6255_B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to…
- 3.7CVE-2024-22403EPSS 0.5%
Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 O…
- 6.5CVE-2024-0350EPSS 0.5%
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. The attack may be launched remot…
- 7.5CVE-2024-0260EPSS 0.5%
A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file change_password_teacher.php of the component Password Change. The manipulation leads…
- 8.8CVE-2023-51772EPSS 0.5%
One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide th…
- 7.5CVE-2023-4320EPSS 0.7%
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage …
- 8.8CVE-2023-49935EPSS 1.0%
An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process…
- 8.8CVE-2023-46326EPSS 0.7%
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.
- 9.8CVE-2023-49091EPSS 0.8%
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid an…
- 4.8CVE-2023-47628EPSS 0.4%
DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do not set an expiration time for a cookie. Due to this, if a session cookie were e…
- 8.2CVE-2023-5889EPSS 0.5%
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- 5.3CVE-2023-39695EPSS 0.5%
Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging out.
- 9.8CVE-2023-5865EPSS 0.7%
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- 9.8CVE-2023-5838EPSS 0.6%
Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.
- 9.8CVE-2023-46158EPSS 0.5%
IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775.
- 6.5CVE-2023-37504EPSS 0.3%
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the app…
- 4.3CVE-2021-20581EPSS 0.4%
IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 199324.
- 2.8CVE-2023-45659EPSS 0.3%
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' …
- 8.1CVE-2023-33303EPSS 0.5%
A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request
- 7.2CVE-2023-42768EPSS 0.7%
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can …
- 8.1CVE-2023-40537EPSS 0.5%
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. Note: Software versions which have reached End of Technical Support (Eo…
- 6.8CVE-2022-3916EPSS 1.0%
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root an…
- 3.9CVE-2023-40732EPSS 0.2%
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking att…
- 3.1CVE-2023-41041EPSS 0.5%
Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Each node maintai…
- 5.3CVE-2023-40178EPSS 0.5%
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could…
- 7.1CVE-2023-40025EPSS 0.6%
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages e…
- 9.8CVE-2023-40174EPSS 0.5%
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does n…
- 8.8CVE-2023-37570EPSS 0.7%
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.
- 6.5CVE-2023-4190EPSS 0.6%
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.
- 8.8CVE-2023-4126EPSS 0.6%
Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
- 9.8CVE-2023-4005EPSS 0.5%
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.
- 7.3CVE-2023-38489EPSS 0.8%
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be a…