1373
<session-config>
<session-timeout>-1</session-timeout>
</session-config>
</web-app>
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 951 SFP Secondary Cluster: Insecure Authentication Policy 888 2396
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Other
The lack of proper session expiration may improve the likely success of certain attacks. For
example, an attacker may intercept a session ID, possibly via a network sniffer or Crosssite
Scripting attack. Although short session expiration times do not help if a stolen token is
immediately used, they will protect against ongoing replaying of the session ID. In another
scenario, a user might access a web site from a shared computer (such as at a library, Internet
cafe, or open work environment). Insufficient Session Expiration could allow an attacker to use
the browser's back button to access web pages previously accessed by the victim.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 47 Insufficient Session Expiration
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Weakness ID : 614
Structure : Simple
Abstraction : Variant
Description
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the
user agent to send those cookies in plaintext over an HTTP session.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 319 Cleartext Transmission of Sensitive Information 779
CWE Version 4.14
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute