2
A programmer erroneously creates a relative link to a page in the application, which does not
switch from HTTP to HTTPS. (This is particularly easy to do when the link moves between public
and secured areas on a web site.)
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms J2EE Misconfiguration: Insecure
Transport
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length
Weakness ID : 6
Structure : Simple
Abstraction : Variant
Description
The J2EE application is configured to use an insufficient session ID length.
Extended Description
If an attacker can guess or steal a session ID, then they may be able to take over the user's
session (called session hijacking). The number of possible session IDs increases with increased
session ID length, making it more difficult to guess or steal a session ID.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 334 Small Space of Random Values 827
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1018 Manage User Sessions 2432
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Background Details
Session ID's can be used to identify communicating parties in a web environment.
The expected number of seconds required to guess a valid session identifier is given by the
equation: (2^B+1)/(2*A*S) Where: - B is the number of bits of entropy in the session identifier. -
A is the number of guesses an attacker can try each second. - S is the number of valid session
identifiers that are valid and available to be guessed at any given time. The number of bits of
entropy in the session identifier is always less than the total number of bits in the session identifier.
CWE Version 4.14
CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length
CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length