According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
View on MITRESet sessions/credentials expiration date.
No detection method information available for this CWE.
The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.
No relationship information available for this CWE.
CWE-613: Insufficient Session Expiration is a Common Weakness Enumeration (CWE) entry maintained by MITRE. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
If exploited, CWE-613 (Insufficient Session Expiration) it can compromise Access Control, leading to outcomes such as Bypass Protection Mechanism.
Recommended mitigations for CWE-613 include: Set sessions/credentials expiration date.
A CWE (Common Weakness Enumeration) like CWE-613 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.