CWE-613: Insufficient Session Expiration

BaseIncomplete

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
Platforms

Frequently Asked Questions

What is CWE-613: Insufficient Session Expiration?+

CWE-613: Insufficient Session Expiration is a Common Weakness Enumeration (CWE) entry maintained by MITRE. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

What are the security consequences of Insufficient Session Expiration?+

If exploited, CWE-613 (Insufficient Session Expiration) it can compromise Access Control, leading to outcomes such as Bypass Protection Mechanism.

How do you prevent or mitigate Insufficient Session Expiration?+

Recommended mitigations for CWE-613 include: Set sessions/credentials expiration date.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-613 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More