目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-384 会话固定 类漏洞列表 145

CWE-384 会话固定 类弱点 145 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-384 会话固定是一种身份验证漏洞，指系统在用户认证后未销毁旧会话标识符，导致攻击者可利用预设的会话ID劫持合法会话。攻击者通常诱导受害者使用其控制的会话ID进行登录，从而窃取权限。开发者应避免此问题，需在用户成功认证或权限变更后强制生成新的会话标识符，并彻底销毁旧会话，确保会话状态与用户身份严格绑定。

MITRE CWE 官方描述
CWE：CWE-384 Session Fixation（会话固定） 在验证用户身份或建立新的用户会话时，如果不使任何现有的会话标识符（Session Identifier）失效，攻击者便有机会窃取已认证的会话。 通常会在以下场景中观察到此类情况：Web 应用在未首先使现有会话失效的情况下对用户进行身份验证，从而继续使用已与用户关联的会话。攻击者能够强制用户接受一个已知的会话标识符，以便在用户完成身份验证后，攻击者即可访问该已认证的会话。应用程序或容器使用可预测的会话标识符。在针对会话固定漏洞的通用利用中，攻击者在 Web 应用中创建一个新会话并记录相关的会话标识符。随后，攻击者诱导受害者使用该会话标识符与服务器建立关联（并可能进行身份验证），从而使攻击者能够通过该活动会话访问用户的账户。
常见影响 (1)
Access ControlGain Privileges or Assume Identity
缓解措施 (3)
Architecture and DesignInvalidate any existing session identifiers prior to authorizing a new user session.
Architecture and DesignFor platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
OperationUse an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Effectiveness: Moderate
代码示例 (2)
The following example shows a snippet of code from a J2EE web application where the application authenticates users with LoginContext.login() without first calling HttpSession.invalidate().
private void auth(LoginContext lc, HttpSession session) throws LoginException { ... lc.login(); ... }
Bad · Java
The following example shows a snippet of code from a J2EE web application where the application authenticates users with a direct post to the <code>j_security_check</code>, which typically does not invalidate the existing session before processing the login request.
<form method="POST" action="j_security_check"> <input type="text" name="j_username"> <input type="text" name="j_password"> </form>
Bad · HTML
CVE ID标题CVSS风险等级Published
CVE-2025-46605 Dell PowerProtect Data Domain（Dell PowerProtect DD） 安全漏洞 — PowerProtect Data Domain 6.2 Medium2026-04-17
CVE-2026-31940 Chamilo LMS 授权问题漏洞 — chamilo-lms 7.5 High2026-04-10
CVE-2026-33946 MCP Ruby SDK 安全漏洞 — ruby-sdk 8.2 -2026-03-27
CVE-2026-33757 OpenBao 授权问题漏洞 — openbao 9.6 Critical2026-03-27
CVE-2026-25101 Bludit 授权问题漏洞 — Bludit 9.1 -2026-03-27
CVE-2025-55266 HCL Aftermarket DPC 安全漏洞 — Aftermarket DPC 5.9 Medium2026-03-26
CVE-2026-33492 WWBN AVideo 授权问题漏洞 — AVideo 7.3 High2026-03-23
CVE-2026-30224 OliveTin 代码问题漏洞 — OliveTin 5.4 Medium2026-03-06
CVE-2026-24352 PluXml CMS 授权问题漏洞 — PluXml CMS 8.2 -2026-02-27
CVE-2026-2177 SourceCodester Prison Management System 授权问题漏洞 — Prison Management System 7.3 High2026-02-08
CVE-2026-23796 OpenSolution Quick.Cart 授权问题漏洞 — Quick.Cart 8.1AIHighAI2026-02-05
CVE-2026-23624 GLPI 授权问题漏洞 — glpi 4.3 Medium2026-02-04
CVE-2025-7014 QRMenümPro Menu Panel 授权问题漏洞 — Menu Panel 5.7 Medium2026-01-29
CVE-2025-7015 AKINSOFT QRMenu 授权问题漏洞 — QR Menu 5.7 Medium2026-01-29
CVE-2025-68139 everest-core 授权问题漏洞 — everest-core 4.3 Medium2026-01-21
CVE-2025-36115 IBM Sterling Connect:Express Adapter for Sterling 授权问题漏洞 — Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 6.3 Medium2026-01-20
CVE-2026-22082 Tenda N300 授权问题漏洞 — 300Mbps Wireless Router F3 and N300 Easy Setup Router 7.4 -2026-01-09
CVE-2020-36913 All-Dynamics enlogic:show 安全漏洞 — enlogic:show Digital Signage System 5.3 Medium2026-01-06
CVE-2023-53776 DB Elettronica Screen SFT DAB 授权问题漏洞 — Screen SFT DAB Series - Compact Radio DAB Transmitter 9.8AICriticalAI2025-12-10
CVE-2023-53775 DB Elettronica Screen SFT DAB 授权问题漏洞 — Screen SFT DAB Series - Compact Radio DAB Transmitter 9.1AICriticalAI2025-12-10
CVE-2023-53741 DB Elettronica Screen SFT DAB 授权问题漏洞 — Screen SFT DAB Series - Compact Radio DAB Transmitter 7.5AIHighAI2025-12-10
CVE-2025-64100 CKAN 授权问题漏洞 — ckan 6.1 Medium2025-10-29
CVE-2025-12390 Red Hat build of Keycloak 授权问题漏洞 — keycloak 6.0 Medium2025-10-28
CVE-2025-10228 Rolantis Agentis 授权问题漏洞 — Agentis 8.8 High2025-10-14
CVE-2025-59841 Flag Forge 代码问题漏洞 — flagForge 9.8 Critical2025-09-25
CVE-2025-4644 Payload 授权问题漏洞 — Payload 8.8 -2025-08-29
CVE-2025-55668 Apache Tomcat 授权问题漏洞 — Apache Tomcat 9.8 -2025-08-13
CVE-2025-8517 Vvveb 安全漏洞 — Vvveb 6.3 Medium2025-08-04
CVE-2025-53102 Discourse 授权问题漏洞 — discourse 8.2AIHighAI2025-07-29
CVE-2025-0253 HCL IEM 安全漏洞 — IEM 2.0 Low2025-07-25

CWE-384（会话固定） 是常见的弱点类别，本平台收录该类弱点关联的 145 条 CVE 漏洞。