目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-384 会话固定 类漏洞列表 145

CWE-384 会话固定 类弱点 145 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-384 会话固定是一种身份验证漏洞，指系统在用户认证后未销毁旧会话标识符，导致攻击者可利用预设的会话ID劫持合法会话。攻击者通常诱导受害者使用其控制的会话ID进行登录，从而窃取权限。开发者应避免此问题，需在用户成功认证或权限变更后强制生成新的会话标识符，并彻底销毁旧会话，确保会话状态与用户身份严格绑定。

MITRE CWE 官方描述
CWE：CWE-384 Session Fixation（会话固定） 在验证用户身份或建立新的用户会话时，如果不使任何现有的会话标识符（Session Identifier）失效，攻击者便有机会窃取已认证的会话。 通常会在以下场景中观察到此类情况：Web 应用在未首先使现有会话失效的情况下对用户进行身份验证，从而继续使用已与用户关联的会话。攻击者能够强制用户接受一个已知的会话标识符，以便在用户完成身份验证后，攻击者即可访问该已认证的会话。应用程序或容器使用可预测的会话标识符。在针对会话固定漏洞的通用利用中，攻击者在 Web 应用中创建一个新会话并记录相关的会话标识符。随后，攻击者诱导受害者使用该会话标识符与服务器建立关联（并可能进行身份验证），从而使攻击者能够通过该活动会话访问用户的账户。
常见影响 (1)
Access ControlGain Privileges or Assume Identity
缓解措施 (3)
Architecture and DesignInvalidate any existing session identifiers prior to authorizing a new user session.
Architecture and DesignFor platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
OperationUse an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Effectiveness: Moderate
代码示例 (2)
The following example shows a snippet of code from a J2EE web application where the application authenticates users with LoginContext.login() without first calling HttpSession.invalidate().
private void auth(LoginContext lc, HttpSession session) throws LoginException { ... lc.login(); ... }
Bad · Java
The following example shows a snippet of code from a J2EE web application where the application authenticates users with a direct post to the <code>j_security_check</code>, which typically does not invalidate the existing session before processing the login request.
<form method="POST" action="j_security_check"> <input type="text" name="j_username"> <input type="text" name="j_password"> </form>
Bad · HTML
CVE ID标题CVSS风险等级Published
CVE-2025-0251 HCL Connections 安全漏洞 — IEM 2.6 Low2025-07-25
CVE-2025-36117 IBM Db2 Mirror for i 授权问题漏洞 — Db2 Mirror for i 6.3 Medium2025-07-23
CVE-2025-52689 Alcatel-Lucent OmniAccess Stellar Products 安全漏洞 — OmniAccess Stellar Products 9.8 Critical2025-07-16
CVE-2025-53021 Moodle 授权问题漏洞 — Moodle 4.2 Medium2025-06-24
CVE-2024-13967 BAB TECHNOLOGIE EIBPORT V3 授权问题漏洞 — EIBPORT V3 KNX 8.8 High2025-06-04
CVE-2024-49709 SoftCOM iKSORIS 授权问题漏洞 — iKSORIS 8.8AIHighAI2025-04-14
CVE-2025-0126 Palo Alto Networks PAN-OS 安全漏洞 — Cloud NGFW 8.8AIHighAI2025-04-11
CVE-2025-29928 authentik 授权问题漏洞 — authentik 8.0 High2025-03-28
CVE-2025-26658 SAP Business One 授权问题漏洞 — SAP Business One (Service Layer) 6.8 Medium2025-03-11
CVE-2025-1412 Mattermost 安全漏洞 — Mattermost 3.1 Low2025-02-24
CVE-2024-49344 IBM OpenPages with Watson 授权问题漏洞 — OpenPages with Watson 4.3 Medium2025-02-20
CVE-2024-42207 HCL iAutomate 安全漏洞 — iAutomate 5.5 Medium2025-02-05
CVE-2024-42171 HCL DRYiCE MyXalytics 安全漏洞 — DRYiCE MyXalytics 6.4 Medium2025-01-11
CVE-2024-42170 HCL DRYiCE MyXalytics 安全漏洞 — DRYiCE MyXalytics 6.8 Medium2025-01-11
CVE-2024-13279 Drupal 安全漏洞 — Two-factor Authentication (TFA) 7.1 -2025-01-09
CVE-2024-56733 Password Pusher 授权问题漏洞 — PasswordPusher 5.7 Medium2024-12-30
CVE-2024-28144 Image Access Scan2Net 安全漏洞 — Scan2Net 9.8 -2024-12-12
CVE-2024-11317 ABB ASPECT 安全漏洞 — ASPECT-Enterprise 10.0 Critical2024-12-05
CVE-2021-3740 Chatwoot 授权问题漏洞 — chatwoot/chatwoot 7.1AIHighAI2024-11-15
CVE-2023-50176 Fortinet FortiOS 授权问题漏洞 — FortiOS 7.1 High2024-11-12
CVE-2024-10318 F5 Nginx 安全漏洞 — NGINX OpenID Connect 5.4 Medium2024-11-06
CVE-2024-23590 Apache Kylin 授权问题漏洞 — Apache Kylin 9.8AICriticalAI2024-11-04
CVE-2024-48929 Umbraco CMS 授权问题漏洞 — Umbraco-CMS 4.2 Medium2024-10-22
CVE-2024-10158 PHPGurukul Boat Booking System 安全漏洞 — Boat Booking System 4.3 Medium2024-10-19
CVE-2024-8643 ValeApp 安全漏洞 — ValeApp 8.8AIHighAI2024-09-27
CVE-2024-45368 AutomationDirect DirectLogic H2-DM1E 授权问题漏洞 — DirectLogic H2-DM1E 8.8 High2024-09-13
CVE-2024-42345 Siemens SINEMA Remote Connect Server 授权问题漏洞 — SINEMA Remote Connect Server 4.3 Medium2024-09-10
CVE-2024-7341 Red Hat Keycloak 授权问题漏洞 7.1 High2024-09-09
CVE-2023-38018 IBM Aspera Shares 授权问题漏洞 — Aspera Shares 6.3 Medium2024-08-09
CVE-2024-38513 Fiber 安全漏洞 — fiber 10.0 Critical2024-07-01

CWE-384（会话固定） 是常见的弱点类别，本平台收录该类弱点关联的 145 条 CVE 漏洞。