CWE-613
Insufficient Session Expiration
Description
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (239)
page 10 of 12| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-27891 | — | 0.00 | — | 0.01 | Mar 6, 2023 | rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1. | ||
| CVE-2023-23929 | 0.00 | — | 0.01 | Mar 3, 2023 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0. | |||
| CVE-2022-24895 | 0.00 | — | 0.01 | Feb 3, 2023 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login,… | |||
| CVE-2023-24426 | 0.00 | — | 0.01 | Jan 24, 2023 | Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. | |||
| CVE-2023-22732 | — | 0.00 | — | 0.01 | Jan 17, 2023 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into… | ||
| CVE-2023-0227 | 0.00 | — | 0.01 | Jan 12, 2023 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. | |||
| CVE-2023-22492 | 0.00 | — | 0.01 | Jan 11, 2023 | ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or… | |||
| CVE-2022-23502 | 0.00 | — | 0.00 | Dec 14, 2022 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This… | |||
| CVE-2022-47406 | — | 0.00 | — | 0.00 | Dec 14, 2022 | An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed. | ||
| CVE-2022-4070 | 0.00 | — | 0.01 | Nov 20, 2022 | Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. | |||
| CVE-2022-3362 | — | 0.00 | — | 0.01 | Nov 14, 2022 | Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0. | ||
| CVE-2022-3867 | 0.00 | — | 0.00 | Nov 10, 2022 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2. | |||
| CVE-2022-41672 | 0.00 | — | 0.01 | Oct 7, 2022 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. | |||
| CVE-2022-2888 | 0.00 | — | 0.00 | Sep 21, 2022 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. | |||
| CVE-2022-31677 | — | 0.00 | — | 0.00 | Aug 29, 2022 | An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their… | ||
| CVE-2022-2713 | 0.00 | — | 0.01 | Aug 8, 2022 | Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. | |||
| CVE-2022-31145 | 0.00 | — | 0.01 | Jul 13, 2022 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users… | |||
| CVE-2022-2306 | 0.00 | — | 0.01 | Jul 5, 2022 | Old session tokens can be used to authenticate to the application and send authenticated requests. | |||
| CVE-2022-31050 | 0.00 | — | 0.01 | Jun 14, 2022 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or… | |||
| CVE-2022-2064 | 0.00 | — | 0.01 | Jun 13, 2022 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. |
- CVE-2023-27891Mar 6, 2023risk 0.00cvss —epss 0.01
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
- CVE-2023-23929Mar 3, 2023risk 0.00cvss —epss 0.01
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- CVE-2022-24895Feb 3, 2023risk 0.00cvss —epss 0.01
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login,…
- CVE-2023-24426Jan 24, 2023risk 0.00cvss —epss 0.01
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
- CVE-2023-22732Jan 17, 2023risk 0.00cvss —epss 0.01
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into…
- CVE-2023-0227Jan 12, 2023risk 0.00cvss —epss 0.01
Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
- CVE-2023-22492Jan 11, 2023risk 0.00cvss —epss 0.01
ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or…
- CVE-2022-23502Dec 14, 2022risk 0.00cvss —epss 0.00
TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This…
- CVE-2022-47406Dec 14, 2022risk 0.00cvss —epss 0.00
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
- CVE-2022-4070Nov 20, 2022risk 0.00cvss —epss 0.01
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.
- CVE-2022-3362Nov 14, 2022risk 0.00cvss —epss 0.01
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- CVE-2022-3867Nov 10, 2022risk 0.00cvss —epss 0.00
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.
- CVE-2022-41672Oct 7, 2022risk 0.00cvss —epss 0.01
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
- CVE-2022-2888Sep 21, 2022risk 0.00cvss —epss 0.00
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
- CVE-2022-31677Aug 29, 2022risk 0.00cvss —epss 0.00
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their…
- CVE-2022-2713Aug 8, 2022risk 0.00cvss —epss 0.01
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
- CVE-2022-31145Jul 13, 2022risk 0.00cvss —epss 0.01
FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users…
- CVE-2022-2306Jul 5, 2022risk 0.00cvss —epss 0.01
Old session tokens can be used to authenticate to the application and send authenticated requests.
- CVE-2022-31050Jun 14, 2022risk 0.00cvss —epss 0.01
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or…
- CVE-2022-2064Jun 13, 2022risk 0.00cvss —epss 0.01
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.