937
Weakness ID : 384
Structure : Composite
Abstraction : Compound
Description
Authenticating a user, or otherwise establishing a new user session, without invalidating any
existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Composite Components
Nature Type ID Name Page
Requires 346 Origin Validation Error 853
Requires 472 External Control of Assumed-Immutable Web Parameter 1123
Requires 441 Unintended Proxy or Intermediary ('Confused Deputy') 1064
Extended Description
Such a scenario is commonly observed when:
• A web application authenticates a user without first invalidating the existing session, thereby
continuing to use the session already associated with the user.
• An attacker is able to force a known session identifier on a user so that, once the user
authenticates, the attacker has access to the authenticated session.
• The application or container uses predictable session identifiers. In the generic exploit of
session fixation vulnerabilities, an attacker creates a new session on a web application and
records the associated session identifier. The attacker then causes the victim to associate,
and possibly authenticate, against the server using that session identifier, giving the attacker
access to the user's account through the active session.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 610 Externally Controlled Reference to a Resource in Another
Sphere