CWE-488 Exposure of Data Element to Wrong Session
baseThe product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (55)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-38367US | critical9.6 | — | ||
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification st… | ||||
| CVE-2026-114637US | high8.7 | — | ||
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated ba… | ||||
| CVE-2024-27935US | high8.3 | — | ||
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows fo… | ||||
| CVE-2024-41977US | high8.0 | — | ||
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.… | ||||
| CVE-2026-54311US | high7.7 | — | ||
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used b… | ||||
| CVE-2022-40210US | high7.8 | — | ||
Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local acc… | ||||
| CVE-2026-18489US | high7.4 | — | ||
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of dat… | ||||
| CVE-2026-5773US | high7.5 | — | ||
libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.
libcurl features a pool of recent connections so that subsequent requests can
reuse an existin… | ||||
| CVE-2026-34391US | high7.5 | — | ||
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM command… | ||||
| CVE-2025-15576US | high7.5 | — | ||
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may no… | ||||
| CVE-2023-1907US | high7.5OT elevated | — | ||
A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection a… | ||||
| CVE-2022-3916US | medium6.8 | — | ||
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root sess… | ||||
| CVE-2026-33215US | medium6.5 | — | ||
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.1… | ||||
| CVE-2026-103544US | medium6.3 | — | ||
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of… | ||||
| CVE-2026-23919US | medium6.0 | — | ||
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss wh… | ||||
| CVE-2024-1223US | medium4.8 | — | ||
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of… | ||||
| CVE-2025-27606US | medium4.6 | — | ||
Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wr… | ||||
| CVE-2026-23844US | medium4.3 | — | ||
Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other… | ||||
| CVE-2026-85296US | — | Exploit | ||
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Signi… | ||||
| CVE-2026-85245US | — | Exploit | ||
Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.… | ||||
03
attack patterns (2)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan