CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- cordea oauth, mediawiki +1 moreSession fixation attacks on improperly configured OAuth 1.0a tools0.0 None
- cap-go capgoCapgo - Login CSRF and Session Fixation via URL Query Parameters5.1 Medium
- ktm system e-bokSession fixation in KTM System e-BOK4.8 Medium
- cactiCacti: Session Fixation via missing session_regenerate_id() after login5.4 Medium
- mispMISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection9.3 Critical
- digiwin easyflow .netDigiwin｜EasyFlow .NET - Session Fixation7.7 High
- mozilla firefox for ios, firefox mobile +1 moreCookie injection was possible when opening a PDF link4.3 Medium
- ether catalyst::plugin::authenticationCatalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks9.1 Critical
- spring framework, vmware spring framework +1 moreSpring Framework Escalation via Session Fixation in WebFlux4.2 Medium
- tittuvarghese collegemanagementsystemtittuvarghese CollegeManagementSystem login-form.php session_start session fixiation5.3 Medium
- No product listedImproper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03...9.8 Critical
- opensolution quickcmsSession Fixation in QuickCMS4.8 Medium
- gradio-app gradioGradio < 6.15.0 Cookie Injection via Shared Proxy Client7.6 High
- apache shiroApache Shiro: Session fixation: new session is not created after login by default5.9 Medium
- vercel turborepoTurborepo: Login callback CSRF/session fixation5.1 Medium
- microsoft visual studio codeVisual Studio Code Elevation of Privilege Vulnerability8.8 High
- artica pandora fms, pandora fms fms +1 moreSession Fixation in Authentication leads to Session Hijacking7.6 High
- No product listeddocuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the...5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access8.1 High
- apache wicketApache Wicket: possible session fixation using AuthenticatedWebSession9.1 Critical
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.2 Medium
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy: Session cookie not cleared when rendering sign-in page3.5 Low
- chamilo lms, chamilo-lms +1 moreSession Fixation in Chamilo LMS7.5 High
- lfprojects mcp ruby sdk, modelcontextprotocol ruby-sdk +1 moreMCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay8.2 High
- bluditSession Fixation in Bludit4.8 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Session Fixation5.9 Medium
- openbao, red hat cryostat 4 +1 moreOpenBao lacks user confirmation for OIDC direct callback mode9.6 Critical
- wwbn avideoAVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration7.3 High
- scadabrScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session...4.8 Medium
- olivetinOliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session5.4 Medium
- pluxml, pluxml cms +1 moreSession Fixation in PluXml CMS4.8 Medium
- No product listedImproper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows...8.2 High
- php frankenphpFrankenPHP leaks session data between requests in worker mode8.7 High
- fast5 prison management systemSourceCodester Prison Management System Login session fixiation6.9 Medium
- opensolution quick.cartSession Fixation in Quick.Cart4.8 Medium
- glpi-project glpiGLPI is vulnerable to session stealing on externally authenticated user change4.3 Medium
- qr menu pro smart menu systems menu panelSession Hijacking in QRMenumPro's Menu Panel5.7 Medium
- akinsoft qr menuSession Hijacking in Akinsoft's QR Menu5.7 Medium
- altumcode 66biolinksA session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application...9.1 Critical
- linuxfoundation everest, everest everest-core +1 moreIn EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing4.3 Medium
- ibm sterling connect:express adapter for sterling b2b integrator 5.2.0, sterling connect\ +1 moreMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.6.3 Medium
- tenda 300mbps wireless router f3 and n300 easy setup routerInsecure Session ID Management Vulnerability in Tenda Wireless Routers8.8 High
- all-dynamics software enlogic:show digital signage systemAll-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass8.5 High
- apple macosA session management issue was addressed with improved checks. This issue is fixed in macOS...3.3 Low
- db elettronica telecomunicazioni spa screen sft dab series - compact radio dab transmitter, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness8.7 High
- db elettronica telecomunicazioni spa screen sft dab series - compact radio dab transmitter, dbbroadcast sft dab 600\/c firmware +1 moreScreen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness7.1 High
- db elettronica telecomunicazioni spa screen sft dab series - compact radio dab transmitter, dbbroadcast sft dab 015\/c firmware, sft dab 050\/c firmware +3 more +5 moreScreen SFT DAB 1.9.3 Authentication Bypass via IP Session Management5.1 Medium
- shridharshukl blood bank management systemA session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that...6.1 Medium
- edly tutorOverhang Tutor Discloses Sensitive Information due to Improper Cache-Control3.3 Low
- tuya smartlife, tuya, tuya smart +2 moreCross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0...8.8 High
- Show moreLoading…