BaseDraft
CWE-488Exposure of Data Element to Wrong Session
Category: auth
Description
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
Common consequences· 1
- Confidentiality — Read Application Data
Potential mitigations· 3
- [Architecture and Design]Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
- [Testing]Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
- [Architecture and Design]In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
Related CAPEC attack patterns· 2
References
Exploits (incoming)2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| AttackPattern | Session Credential Falsification through Predictioncapec-59 | 100% | live |
| AttackPattern | Reusing Session IDs (aka Session Replay)capec-60 | 100% | live |
(incoming)2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Vulnerability | CVE-2025-1247cve-2025-1247 | 0% | live |
| Vulnerability | CVE-2025-47928cve-2025-47928 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.