Skip to content
OpenAdvisories

Weakness (CWE)

CWE-613: DEPRECATED: Insufficient Session Expiration

Base Deprecated Mapping prohibited

This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

Source: MITRE CWE-613

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm
  • Low 2.9
    CVE-2021-34428 Public exploit

    SessionListener can prevent a session from being invalidated breaking logout

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple con…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven