CWE-324 Use of a Key Past its Expiration Date
baseThe product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (33)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-8014US | critical9.8OT hoch | — | ||
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCrede… | ||||
| CVE-2022-28747US | critical9.8 | — | ||
Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution. To exploit this vulnerability, an attacker must craft and sign a ser… | ||||
| CVE-2026-43585US | critical9.8 | — | ||
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handl… | ||||
| CVE-2025-2291US | critical9.8 | — | ||
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired p… | ||||
| CVE-2022-35401US | high8.1 | — | ||
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to ful… | ||||
| CVE-2019-10643US | critical9.8 | — | ||
Contao 4.7 allows Use of a Key Past its Expiration Date. | ||||
| CVE-2025-33012US | high8.8 | — | ||
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account… | ||||
| CVE-2022-24732US | high8.8 | — | ||
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating u… | ||||
| CVE-2001-1475US | high7.5OT erhöht | — | ||
SSH before 2.0, when using RC4 and password authentication, allows remote attackers to replay messages until a new server key (VK) is generated. | ||||
| CVE-2025-13723US | high7.5 | — | ||
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access tok… | ||||
| CVE-2021-33020US | high7.5 | — | ||
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing windo… | ||||
| CVE-2024-31895US | medium6.5 | — | ||
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288176… | ||||
| CVE-2024-25679US | medium6.5 | — | ||
In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by sending a CONNECTION_CLOSE frame that is e… | ||||
| CVE-2022-2447US | medium6.6 | — | ||
A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually r… | ||||
| CVE-2013-2104US | medium5.5 | — | ||
python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use… | ||||
| CVE-2019-3790US | medium5.4 | — | ||
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration th… | ||||
| CVE-2004-0163US | medium5.0 | — | ||
Sygate Secure Enterprise (SSE) 3.5MR3 and earlier does not change the key used to encrypt data, which allows remote attackers to cause a denial of service (resource exhaustion) by… | ||||
| CVE-2025-48813US | medium4.7 | — | ||
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally. | ||||
| CVE-2024-7318US | medium4.8 | — | ||
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deeme… | ||||
| CVE-2025-71435US | medium4.2 | — | ||
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Use… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan