Weakness (CWE)
CWE-613: DEPRECATED: Insufficient Session Expiration
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
Source: MITRE CWE-613
615 results · Feed
-
High 7.5
BIG-IP Next Central Manager vulnerability
The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Low 3.5
An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, …
-
Medium 4.7
IBM Cloud Pak for Security session fixation
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 23367…
-
Critical 9.8
Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from loggin…
-
Medium 5.5
IBM Aspera Orchestrator session fixation
IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477.
-
Medium 5.3
IBM Security Directory Server information disclosure
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 uses insufficient session expiration which could allow an unauthorized user to obtain sensitive information. IBM X-Force ID: 228565.
-
Critical 9.1
Apache StreamPark: session not invalidated after logout
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even a…
-
High 7.4
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
-
High 7.7
Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an a…
-
High 7.3
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via…
-
High 8.8
Soar Cloud HR Portal - Insufficient Session Expiration
The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused.
-
Medium 6.5
An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after …
-
High 7.7
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected …
-
Low 3.9
Insufficient Session Expiration in zenml-io/zenml
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain acces…
-
High 7.5
zfr authentication adapter did not verify validity of tokens
Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a (release [0.1.2](https://github.com/zf-fr/zfr-oauth2-server-module/tree/0.1.2)), tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted …
-
Low 3.1
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
-
High 7.4
@fastify/session reuses destroyed session cookie
@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired…
-
High 7.8
Reportico Web fails to invalidate cookies upon logout
An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function.
-
Medium 5.4
Directus Lacks Session Tokens Invalidation
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie…
-
High 8.8
An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was de…
-
Critical 9.1
SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022…
-
Medium 4.3
An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.
-
Medium 6.3
An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not termina…
-
Medium 6.3
IBM Cognos Controller session fixation
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.
-
Medium 6.5
Keycloak: session hijacking via re-authentication
A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=log…
-
Medium 4.3
cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious…
-
Medium 6.3
IBM UrbanCode Deploy session fixation
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another u…
-
High 7.4
@fastify/secure-session: Reuse of destroyed secure session cookie
@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, …
-
Medium 4.3
zcap has incomplete expiration checks in capability chains.
`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is n…
-
Medium 5.9
Contao's remember-me tokens will not be cleared after a password change
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an accou…
-
Medium 5.3
Shopware has Improper Session Handling in store-api
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User…
-
Medium 5.3
Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A re…
-
Critical 9.8
xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted …
-
High 7.7
Insufficient session timeout vulnerability in Sagemcom router
Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Lo…
-
Medium 5.6
A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid”…
-
Medium 6.1
An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges…
-
Critical 9.1
In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token w…
-
Medium 6.3
[20240201] - Core - Insufficient session expiration in MFA management views
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
-
Medium 6.5
Apache DolphinScheduler: Session do not expire after password change
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
-
Medium 4.8
Insufficient Session Expiration in github.com/greenpau/caddy-security
All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout …