939
The following example shows a snippet of code from a J2EE web application where the application
authenticates users with a direct post to the <code>j_security_check</code>, which typically does
not invalidate the existing session before processing the login request.
Example Language: HTML (Bad)
<form method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="text" name="j_password">
</form>
Observed Examples
Reference Description
CVE-2022-2820 Website software for game servers does not proprerly terminate user sessions,
allowing for possible session fixation
https://www.cve.org/CVERecord?id=CVE-2022-2820
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 361 7PK - Time and State 700 2320
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Other
Other attack vectors include DNS poisoning and related network based attacks where an
attacker causes the user to visit a malicious site by redirecting a request for a valid site. Network
based attacks typically involve a physical presence on the victim's network or control of a
compromised machine on the network, which makes them harder to exploit remotely, but their
significance should not be overlooked. Less secure session management mechanisms, such as
the default implementation in Apache Tomcat, allow session identifiers normally expected in a
cookie to be specified on the URL as well, which enables an attacker to cause a victim to use a
fixed session identifier simply by emailing a malicious URL.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Session Fixation
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
WASC 37 Session Fixation
Related Attack Patterns
CWE Version 4.14
CWE-385: Covert Timing Channel
CWE-385: Covert Timing Channel