Skip to content
OpenAdvisories

Weakness (CWE)

CWE-539: Use of Persistent Cookies Containing Sensitive Information

Variant Incomplete

The web application uses persistent cookies, but the cookies contain sensitive information.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Do not store sensitive information in persistent cookies.

Source: MITRE CWE-539

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-35192

    Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached p…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 3.1
    CVE-2025-52633

    HCL AION is susceptible to Missing Content-Security-Policy

    HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. This issu…

    HCL AION