CWE-384Session Fixation

Description

Common consequences· 1

• Access Control — Gain Privileges or Assume Identity

Potential mitigations· 3

• [Architecture and Design]Invalidate any existing session identifiers prior to authorizing a new user session.
• [Architecture and Design]For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
• [Operation]Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Related CAPEC attack patterns· 7

Exploits (incoming)7

(incoming)30

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.