CWE-384 Session Fixation
compoundAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (607)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-102489US | critical9.8OT critical | KEV | ||
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to ver… | ||||
| CVE-2018-11714US | critical9.8 | Exploit | ||
An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. T… | ||||
| CVE-2018-18925US | critical9.8 | Exploit | ||
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go.… | ||||
| CVE-2017-12965US | critical9.8 | Exploit | ||
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter. | ||||
| CVE-2019-10008US | high8.8 | Exploit | ||
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrato… | ||||
| CVE-2006-0685US | high10.0 | Exploit | ||
The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain un… | ||||
| CVE-2021-36394US | critical9.8 | Exploit | ||
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. | ||||
| CVE-2015-4594US | critical9.8 | Exploit | ||
eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possi… | ||||
| CVE-2003-1245US | high10.0 | Exploit | ||
index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie. | ||||
| CVE-2019-18418US | critical9.8 | Exploit | ||
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management. | ||||
| CVE-2019-12258US | high7.5 | Exploit | ||
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options. | ||||
| CVE-2017-6412US | high8.1 | Exploit | ||
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310. | ||||
| CVE-2017-14263US | high8.1 | Exploit | ||
Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that sessi… | ||||
| CVE-2009-1634US | high7.5 | Exploit | ||
The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to g… | ||||
| CVE-2005-0614US | high7.5 | Exploit | ||
sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie. | ||||
| CVE-2021-20151US | critical10.0 | — | ||
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rathe… | ||||
| CVE-2015-1820US | critical9.8 | — | ||
REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cook… | ||||
| CVE-2014-3060US | high10.0OT elevated | — | ||
Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.5 allows remote attackers to obtain administrative privileges by leveraging access to an eXtreme Scale dis… | ||||
| CVE-2013-5446US | high10.0 | — | ||
The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors. | ||||
| CVE-2012-0290US | high10.0 | — | ||
Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (… | ||||
03
attack patterns (7)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan