CWEweakness
CWE-1462 Improper Session Management
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not properly manage user-related sessions such as setting appropriate configurations and settings for sessions on creation and handling sessions throughout their lifetime.
Potential mitigations
• [Architecture and Design, Implementation, Operation] Very carefully manage user authenticated sessions. Ensure that appropriate timeouts, invalidation procedures, and protections are established.
Observed examples
• CVE-2020-6291: No absolute session expiration
• CVE-2021-38869: Session was not invalidated after inactivity
• CVE-2019-12421: Chain: log out invalidated the session on the client side (CWE-602), but not the server side (CWE-1464)
Related
Observed example · CVE (3)
- CVE-2021-38869 IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. vulnerability
- CVE-2020-6291 SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after… vulnerability
- CVE-2019-12421 When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the… vulnerability
Child of · CWE (1)
- CWE-284 Improper Access Control weakness