CWE-384

Session Fixation

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

416 vulnerabilities with CWE-384
CVE-2025-29928 HIGH
authentik <2024.12.4, <2025.2.3 - Info Disclosure
CVSS 8.0
CVE-2025-26658 MEDIUM
SAP Business One - Privilege Escalation
CVSS 6.8
CVE-2025-27661 CRITICAL
Vasion Print <22.0.843 - Session Fixation
CVSS 9.1
CVE-2025-1412 LOW
Mattermost <9.11.7, <10.4.2 - Privilege Escalation
CVSS 3.1
CVE-2025-22216 MEDIUM
Cloud Foundry UAA 77.20.X-77.20.1 and 77.2X.0-77.24.X - Session Fixation via Zone Validation Bypass
CVSS 5.4
CVE-2025-24503 CRITICAL
Symantec Privileged Access Management 3.4.6-4.1.7 and 4.2.0 - Session Fixation via Crafted Link
CVE-2025-24502 MEDIUM
Broadcom Symantec Privileged Access Management - Improper Session Validation
CVE-2024-13967 HIGH
EIBPORT V3 KNX/GSM <3.9.8 - Unauthorized Access
CVSS 8.8
CVE-2024-49709 MEDIUM
SoftCOM iKSORIS - Session Hijacking
CVSS 4.4
CVE-2024-49344 MEDIUM
IBM OpenPages with Watson <9.0 - Info Disclosure
CVSS 4.3
CVE-2024-42207 MEDIUM
HCL iAutomate - Session Fixation
CVSS 5.5
CVE-2024-56529 HIGH
Mailcow <2024-11b - Session Fixation
CVSS 7.1
CVE-2024-57052 CRITICAL
youediancms <9.5.20 - Privilege Escalation
CVSS 9.8
CVE-2024-42171 MEDIUM
HCL MyXalytics - Session Fixation via Crafted URL
CVSS 6.4
CVE-2024-42170 MEDIUM
HCL MyXalytics - Session Fixation via Crafted URL Session Token
CVSS 6.8
CVE-2024-13279 CRITICAL
Drupal TFA <1.8.0 - Session Fixation
CVSS 9.8
CVE-2024-56733 MEDIUM
Password Pusher <1.50.3 - Info Disclosure
CVSS 5.7
CVE-2024-28144 MEDIUM
Image Access Scan2Net 7.42B - Session Takeover
CVSS 5.5
CVE-2024-50339 MEDIUM
GLPI 9.5.0-10.0.16 - Unauthenticated Session ID Exposure and Hijacking
CVSS 5.3
CVE-2024-11317 CRITICAL
ABB ASPECT Enterprise and MATRIX Series - Session Fixation
CVSS 10.0
CVE-2024-10318 MEDIUM
NGINX OpenID Connect - Session Fixation
CVSS 5.4
CVE-2024-23590 CRITICAL
Apache Kylin <5.0.0 - Session Fixation
CVSS 9.1
CVE-2024-48929 MEDIUM
Umbraco <13.5.2-10.8.7 - Info Disclosure
CVSS 4.2
CVE-2024-10158 MEDIUM
PHPGurukul Boat Booking System 1.0 - Session Fixation
CVSS 4.3
CVE-2024-8643 CRITICAL
Oceanic Software ValeApp <2.0.0 - Session Fixation
CVSS 9.8
Details
Vulnerabilities 416
Links
MITRE CWE Entry Search this CWE With Exploits