CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- intel baseboard management controller firmwareInsufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an...7.1 High
- adobe systems incorporated magento 2, magento +1 moreInsecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2...7.5 High
- apache impalaIn Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala...7.5 High
- oxid-esales eshopAn issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop...8.8 High
- clonosclonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via...9.8 Critical
- eq-3 homematic ccu3 firmwareeQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs...7.3 High
- juniper junos, juniper networks junos os +1 moreJunos OS: Session fixation vulnerability in J-Web7.5 High
- ibm mqIBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners...5.6 Medium
- ibm websphere application serverIBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security...6.3 Medium
- lenovo thinkagile cp-sb, cp storage block firmware +1 moreAn internal product security audit discovered a session handling vulnerability in the web...7.5 High
- silverstripeSession fixation in change password form6.3 Medium
- bd pyxis enterprise server, pyxis es +1 moreIn Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server...8.8 High
- windriver vxworks, belden garrettcom magnum dx940e firmware, hirschmann hios +9 more +11 moreWind River VxWorks 6.5 through 6.9 and vx7 has Session Fixation in the TCP component. This is a...7.5 High
- hewlett packard enterprise (hpe) hpe 3par storeserv management and core software media, hp 3par storeserv management console +1 moreA remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core...7.2 High
- hewlett packard enterprise (hpe) hpe 3par service processor, hp 3par service processor firmware +1 moreA remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s):...6.3 Medium
- jenkins project gitlab authentication plugin, jenkins gitlab oauth +1 moreJenkins Gitlab Authentication Plugin vulnerable to Session Fixation7.5 High
- magentoMagento 2 Community Edition Session Fixation Check7.5 High
- ibm cloud privateIBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could...5.9 Medium
- eq-3 ccu2 firmware, ccu3 firmware +1 moreOn eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login...8.8 High
- ibm security access managerIBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely...5.1 Medium
- siemens ag logo!8, siemens logo\!8 firmware +1 moreA vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 /...8.8 High
- pydioThe "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session...6.5 Medium
- cisco umbrellaCisco Umbrella Dashboard Session Management Vulnerability7.6 High
- bpcbt smartvistaBPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.7.5 High
- zohocorp servicedesk plusZoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an...8.8 High
- apache zeppelinSession Fixation in Apache Zeppelin8.1 High
- ivanti connect secure, pulsesecure pulse connect secure, pulse secure desktop client +2 moreIn Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens...8.1 High
- axiomsl axiomAxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation...8.8 High
- ibm security privileged identity managerIBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session...3.1 Low
- vmware vcloud director, vcloud director for service providers (vcd) +1 moreVMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote...9.8 Critical
- atlassian crowdThe console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before...8.1 High
- phoenixcontact fl nat smcs 8tx firmware, fl nat smn 8tx-m-dmg firmware, fl nat smn 8tx-m firmware +1 more +3 moreAn issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and...8.8 High
- cloud foundry stratosCloud Foundry Stratos contains a Session Collision Vulnerability8.2 High
- cloud foundry stratosCloud Foundry Stratos Deploys With Public Default Session Store Secret8.7 High
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not...4.3 Medium
- intel data center managerInsufficient session authentication in web server for Intel(R) Data Center Manager SDK before...8.8 High
- atlassian crowdVarious rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before...8.1 High
- dbninjaDbNinja 3.2.7 allows session fixation via the data.php sessid parameter.9.6 Critical
- jenkins project github authentication plugin, jenkins github oauth +1 moreGitHub Authentication Plugin session fixation vulnerability5.9 Medium
- ibm security identity managerIBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the...4.0 Medium
- zoneminderSession fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session...7.3 High
- apache http server, canonical ubuntu linux, debian linux +3 more +5 moreIn Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time...7.5 High
- jenkinsSession Fixation in Jenkins5.4 Medium
- ibm security access manager appliance, security access manager +1 moreIBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not...3.7 Low
- hclsoftware bigfix platformIBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable...3.1 Low
- hclsoftware bigfix platformIBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute...3.7 Low
- hclsoftware bigfix platformIBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly'...4.0 Medium
- terra-master terramaster operating systemSession Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to...5.4 Medium
- trytonSession Fixation in Tryton5.9 Medium
- brocade fabric os, broadcom fabric operating system +1 moreA vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1...7.5 High
- Show moreLoading…