CWE-613: Insufficient Session Expiration

Description

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Submission Date :

May 7, 2007, midnight

Modification Date :

2023-06-29 00:00:00+00:00

Organization :

MITRE
Example Vulnerable Codes

Example - 1

The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.


<session-timeout>-1</session-timeout>[...snipped...]<session-config></session-config><web-app></web-app>

Related Weaknesses

This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.

CWE-287: Improper Authentication
Go to
CWE-352: Cross-Site Request Forgery (CSRF)
Go to
CWE-672: Operation on a Resource after Expiration or Release
Go to

Visit http://cwe.mitre.org/ for more details.