CWE-613 不充分的会话过期机制

Insufficient Session Expiration

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 672 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 672 cwe_View_ID: 1003 cwe_Ordinal: Primary

• cwe_Nature: CanPrecede cwe_CWE_ID: 287 cwe_View_ID: 1000

• cwe_Nature: CanPrecede cwe_CWE_ID: 287 cwe_View_ID: 699

常见的影响

范围	影响	注释
Access Control	Bypass Protection Mechanism

可能的缓解方案

Implementation

策略:

Set sessions/credentials expiration date.

示例代码

例

The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.

bad Java

Notes

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
WASC	47		Insufficient Session Expiration

文章来源于互联网:scap中文网