CWE-613: Insufficient Session Expiration

Description

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Potential Impact

Access Control: Bypass Protection Mechanism

How to Fix

Implementation

Set sessions/credentials expiration date.

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-613 vulnerabilities in your codebase.

Get Security Assessment