CWE-384

Session Fixation

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

416 vulnerabilities with CWE-384

CVE-2015-1174 CRITICAL

Unit4 Polska TETA Web <22.62.3.4 - Info Disclosure

CVSS 9.8

CVE-2015-4594 CRITICAL

eClinicalWorks Population Health - Session Fixation

CVSS 9.8

CVE-2014-125048 MEDIUM

xingwall < e9f0d509e1408743048e29d9c099d36e0e1f6ae7 - Session Fixation in OAuth Controller

CVSS 6.3

CVE-2014-10400 MEDIUM

CGILua 5.0.x - Session Fixation via Predictable Session ID

CVSS 6.1

CVE-2014-10399 MEDIUM

CGILua 5.1.x - Session Fixation via Weak Session ID

CVSS 6.1

CVE-2014-4789

IBM Initiate Master Data Service <10.1 - Session Fixation

CVE-2013-4572 HIGH

MediaWiki <1.19.9, <1.20.8, <1.21.3 - Auth Bypass

CVSS 7.5

CVE-2013-0507 HIGH

IBM InfoSphere Information Server <9.1 - Privilege Escalation

CVSS 8.1

CVE-2013-2049 HIGH

Red Hat CloudForms Management Engine - Session Fixation via Static Secret Token

CVSS 7.5

CVE-2010-1434 HIGH

Joomla! Core <1.5.16 - Session Fixation

CVSS 7.5

CVE-2010-3671 MEDIUM

TYPO3 <4.1.14, <4.2.13, <4.3.4, <4.4.1 - Info Disclosure

CVSS 6.5

CVE-2009-10007 CRITICAL

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks

CVSS 9.1

CVE-2008-3222

Drupal 5.x < 5.9 and 6.x < 6.3 - Session Fixation

CVE-2007-4188

Joomla! < 1.0.13 - Session Fixation

CVE-2001-1534

Apache HTTP Server 1.3.11-1.3.20 - Session Fixation via Predictable mod_usertrack Session IDs

CVE-1999-0428

OpenSSL < 0.9.2b - Session Fixation

Details

Vulnerabilities 416

Links