CWEweakness
CWE-1464 Improper Session Invalidation
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product establishes a session for an authenticated user, but it does not properly invalidate or terminate the session when it is required.
Potential mitigations
• [Implementation] Ensure that user sessions are invalidated on the server-side for all possible security related events relevant to the application. It is important that the server-side handles all session invalidation and does not rely on the client to remove or delete a session, due to the possibility of adversaries capturing session identifiers or cookies for later reuse.
Detection methods
• Dynamic Analysis with Manual Results Interpretation: Ensure that application testing includes scenarios that are intended to lead to session invalidation and verify that the session can no longer be used.
Observed examples
• CVE-2021-38869: Session was not invalidated after inactivity
• CVE-2019-5638: Session not invalidated after security relevant account change
Related
Observed example · CVE (2)
- CVE-2021-38869 IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. vulnerability
- CVE-2019-5638 Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant… vulnerability
Child of · CWE (1)
- CWE-1462 Improper Session Management weakness