CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- cubecartCubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie...5.4 Medium
- versa-networks versa operating systemIn VOS user session identifier (authentication token) is issued to the browser prior to...8.8 High
- runzero platform, shopware +1 morePotential Session Hijacking in Shopware5.9 Medium
- netgear gs116e firmware, jgs516pe firmware +1 moreThe authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2...8.8 High
- micro focus solutions business managerSession fixation4.8 Medium
- pi-holePi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new...5.4 Medium
- ibm spectrum protect operations centerIBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass...4.2 Medium
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password...4.0 Medium
- moxa nport iaw5000a-i/o, nport iaw5000a-i\/o firmware +1 moreMOXA NPort IAW5000A-I/O Series8.8 High
- ibm financial transaction managerIBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which...6.3 Medium
- mitsubishi electric corporation gt14 model of got 1000 series, mitsubishielectric coreos +1 moreSession fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT...7.5 High
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 moreSession fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series ...7.5 High
- ibm security directory serverIBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or...3.7 Low
- solarwinds n-centralSolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or...8.8 High
- redhat wildfly elytron, netapp oncommand insight, redhat codeready studio +4 more +6 moreSession Fixation in WildFly Elytron7.5 High
- sap commerceSAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL...6.4 Medium
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote...3.7 Low
- ibm planning analyticsIBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused...5.9 Medium
- sap disclosure managementSAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the...4.2 Medium
- ibm maximo asset managementIBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could...5.9 Medium
- mitsubishielectric coreos, mitsubishi electric corporation got2000 series gt27, gt25, and gt23 +1 moreTCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with...7.5 High
- playsmsplaySMS through 1.4.3 is vulnerable to session fixation.6.5 Medium
- ibm mobile foundation, mobilefirst platform foundation +1 moreIBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user...5.6 Medium
- sysax multi serverAn issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the...8.8 High
- jenzabar internet campus solutionJenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and...9.8 Critical
- rconfigrConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are...9.1 Critical
- palo alto networks pan-osPAN-OS: GlobalProtect Portal PHP session fixation vulnerability3.7 Low
- f5 nginx controllerOn versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side...8.1 High
- intelliants subrionSession Fixation in Subrion CMS6.5 Medium
- [kiali] kiali, redhat openshift service mesh +1 moreInsufficient Session Expiration in Kiali7.0 High
- davical andrew\'s web libraries, debian linux +1 moreAn issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management...7.5 High
- davical andrew\'s web libraries, debian linux +1 moreAn issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session...9.8 Critical
- argoproj argo cdAs of v1.5.0, the Argo web interface authentication system issued immutable tokens....7.5 High
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose...4.7 Medium
- plat'home co.,ltd. easyblocks ipv6, plathome easyblocks ipv6 enterprise firmware, easyblocks ipv6 firmware +2 moreSession fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0...8.1 High
- mozilla firefoxInitially, a user opens a Private Browsing Window and generates a password for a site, then...2.8 Low
- ctfd rctfsession fixation in rCTF6.5 Medium
- halvotec raquest** DISPUTED ** An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session...5.4 Medium
- ibm cloud automation managerIBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful...5.9 Medium
- mitsubishi electric corporation electric melqic iu1 series, mitsubishielectric iu1-1m20-d firmware +1 moreTCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D...9.8 Critical
- humaxdigital hga12r-02 firmwareHUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijacking.9.1 Critical
- western digital ibi, my cloud home +1 moreWestern Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.9.1 Critical
- keplerproject cgiluaThe session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for...6.1 Medium
- keplerproject cgiluaThe session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote...6.1 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability8.1 High
- hackerone nextcloud server, nextcloud server +1 moreA bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the...5.9 Medium
- danschultzer powSession fixation attack in Pow (Hex package)6.5 Medium
- infinispan, redhat jboss data grid +1 moreImproper implementation of the session fixation protection in Infinispan5.4 Medium
- apache tomcat, canonical ubuntu linux, debian linux +8 more +10 moreIn Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack7.5 High
- dell rsa identity governance and lifecycle, rsa identity governance & lifecycle +1 moreThe RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to...8.7 High
- Show moreLoading…