CWEweakness
CWE-539 Use of Persistent Cookies Containing Sensitive Information
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The web application uses persistent cookies, but the cookies contain sensitive information.
Common consequences
• Confidentiality: Read Application Data — This can cause privacy issues depending on the information stored in the cookie and how it is accessed.
• Confidentiality: Bypass Protection Mechanism — If the cookie is used for a protection mechanism (e.g., credentials), then an attacker might be able to bypass the mechanism using information from the cookie.
Potential mitigations
• [Architecture and Design] Do not store sensitive information in persistent cookies.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Related
Attack pattern · CAPEC (5)
- CAPEC-21 Exploitation of Trusted Identifiers attack pattern
- CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies attack pattern
- CAPEC-39 Manipulating Opaque Client-based Data Tokens attack pattern
- CAPEC-59 Session Credential Falsification through Prediction attack pattern
- CAPEC-60 Reusing Session IDs (aka Session Replay) attack pattern
Child of · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
Referenced by CAPEC · weakness (5)
- CAPEC-21 Exploitation of Trusted Identifiers attack pattern
- CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies attack pattern
- CAPEC-39 Manipulating Opaque Client-based Data Tokens attack pattern
- CAPEC-59 Session Credential Falsification through Prediction attack pattern
- CAPEC-60 Reusing Session IDs (aka Session Replay) attack pattern
Referenced by CVE · weakness (7)
- CVE-2026-35192 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. vulnerability
- CVE-2026-24318 Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker… vulnerability
- CVE-2025-52633 HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. vulnerability
- CVE-2025-27673 Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body… vulnerability
- CVE-2024-39275 Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. vulnerability
- CVE-2023-30861 Flask is a lightweight WSGI web application framework. vulnerability
- CVE-2021-27463 A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. vulnerability