Weakness (CWE)

CWE-1465: Improper Session Invalidation after User Logout

Variant Incomplete

The product provides a logout functionality or otherwise attempts to end an active session for a user, but it does not properly invalidate the session upon logout.

How to prevent it (1 mitigation)

Implementation

Ensure that user sessions are invalidated on the server-side after a client logs out or attempts to end their session. It is important that the server-side handles all session invalidation – including multiple tabs or windows, such as within a web browser - and does not rely on the client to remove or delete a session due to the possibility of adversaries capturing session identifiers or cookies for later reuse.

Source: MITRE CWE-1465

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.