Weakness (CWE)
CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
More detail
Such a scenario is commonly observed when:
- A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
- An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
- The application or container uses predictable session identifiers.
In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
How to prevent it (3 mitigations)
-
Architecture and Design
Invalidate any existing session identifiers prior to authorizing a new user session.
-
Architecture and Design
For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-384
330 results · Feed
-
High 7.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can …
-
High 7.6
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL…
-
Medium 6.1
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered…
-
Medium 4.2
Tribal Systems Zenario CMS Remember Me session fixiation
A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initi…
-
Medium 6.5
An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSES…
-
High 8.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is po…
-
Medium 4.6
Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in …
-
Medium 5.4
Concrete CMS vulnerable to Session Fixation
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
-
Critical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a v…
-
High 7.5
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versi…
-
Critical 9.8
Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.
The application was vulnerable to a session fixation that could be used hijack accounts.
-
Medium 5.8
Session Fixation and Insufficient Session Expiration
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
-
High 7.5
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA0…
-
Medium 6.5
Improper Session Management Vulnerability in Tacitine Firewall
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticate…
-
Medium 6.4
Session Fixation in ikus060/rdiffweb
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
-
High 8.8
Login check vulnerability by session Id
Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
-
Critical 9.8
Session Fixation
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
-
Medium 4.6
Session Fixation in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
-
High 8.8
A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3…
-
High 7.0
Session Fixation in namelessmc/nameless
Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2.
-
Medium 5.4
Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could …
-
High 8.1
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote …
-
Medium 4.8
Session Fixation
This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
-
Medium 6.5
Hybridsessions does not expire session id on logout
Silverstripe silverstripe/framework through 4.10 allows Session Fixation.
-
Medium 4.3
Session Fixation in filegator/filegator
Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
-
Medium 6.5
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges.
-
High 7.1
Malicious users can take over the session of other players
Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0…
-
Medium 4.8
Guest session is shared between customers in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. …
-
Medium 4.6
Session fixation in express-openid-connect
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application…
-
Medium 6.5
Cookie persistence in Symfony
Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes …
-
Unscored —
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provid…
-
High 7.5
Session fixation vulnerability in Jenkins
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.
-
Medium 5.9
Potential Session Hijacking in Shopware
Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via th…
-
Unscored —
Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary s…
-
Medium 6.5
Session Fixation in Nextcloud Talk
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended tha…
-
Unscored —
In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not chang…
-
Medium 4.8
Session fixation
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.
-
High 8.8
MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies.
-
High 7.5
Session Fixation in WildFly Elytron
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confid…
-
Medium 6.4
SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application i…