CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- d-link dir-600l firmwareSession fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17...9.8 Critical
- simplesamlphp, debian linux +1 moreIncorrect persistent NameID generation in SimpleSAMLphp9.8 Critical
- simplesamlphpSimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module9.8 Critical
- apache2triadSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web...9.8 Critical
- unit4 teta webSession fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and...9.8 Critical
- ibm security appscan enterprise, security appscan +1 moreIBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an...8.1 High
- ipsilon project ipsilonSession Fixation in ipsilon9.1 Critical
- canonical ubuntu-imageubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting...5.9 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreSession fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform...5.4 Medium
- pivotal software cloud foundry cf-release, cloud foundry uaa, cloud foundry uaa-release +2 moreAn issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier...8.1 High
- mcafee network data loss prevention (ndlp), network data loss prevention +1 moreSession Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9...8.0 High
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an...3.5 Low
- [unknown] nss, mozilla network security services +1 morenss before version 3.30 is vulnerable to a remote denial of service during the session handshake...5.9 Medium
- clusterlabs pcs, fedoraproject fedora, redhat enterprise linux +2 moreSession fixation vulnerability in pcsd in pcs before 0.9.157.8.1 High
- apache cxfSession Fixation in Apache CXF7.5 High
- ibm financial transaction managerIBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with...4.3 Medium
- sophos web applianceIn Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.8.1 High
- revive-adserver revive adserverRevive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session...9.8 Critical
- revive-adserver revive adserverSession fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1,...5.9 Medium
- zoneminderSession fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack...7.3 High
- honeywell xl web ii controllerAn issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior,...6.0 Medium
- ibm security identity manager virtual appliance, ibm corporation identity manager +1 moreIBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could...2.4 Low
- ibm tivoli storage manager, ibm corporation tivoli storage manager extended edition +1 moreTivoli Storage Manager Operations Center could allow a local user to take over a previously...7.0 High
- ibm rational collaborative lifecycle managementIBM Jazz Foundation could allow an authenticated user to take over a previously logged in user...5.0 Medium
- eclinicalworks population healtheClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When...9.8 Critical
- phpmyadminphpMyAdmin Bypass logout timeout5.3 Medium
- sensiolabs symfonySymfony Session Fixation Vulnerability6.8 Medium
- djangoproject djangoDjango allows user sessions hijacking via an empty string in the session key5.0 Medium
- rest-client project rest-clientrest-client Gem Vulnerable to Session Fixation9.8 Critical
- ibm initiate master data serviceSession fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7...6.8 Medium
- mediawiki, fedoraproject fedora +1 moreThe CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before...7.5 High
- openstack horizonOpenStack Horizon Session Fixation6.8 Medium
- typo3TYPO3 is vulnerable to Session Fixation6.5 Medium
- moodleMoodle Session Fixation vulnerability6.8 Medium
- typo3Authentication library in TYPO3 vulnerable to session fixation7.5 High
- drupal, fedoraproject fedora +1 moreSession fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed...5.8 Medium
- david hansson ruby on railsSession fixation vulnerability in Rails6.8 Medium
- joomla joomla\!Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to...9.3 High
- apache http servermod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable...2.1 Low
- opensslOpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.7.5 High